CVE-2017-16943Exim Use-After-Free
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.
Published May 5, 2021 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2017-16943, DSA-4053-1, UBUNTU-CVE-2017-16943
Key Facts
Patch in the next maintenance window- CVE-2017-16943 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Exim, Debian Linux, exim4 (debian) and 9 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 47% probability of exploitation in the next 30 days.
- Fixed versions are available, including Exim 4.86.2-17.1, Exim 4.89-4.17.amzn1, Exim 4.89-r7.
- Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Scores
CVSS v3.1
9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
47%
Higher than 98.8% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
48/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
1
Reports of active use
Advisories And Exploit References
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2017-16943
- advisoryhttps://ubuntu.com/security/CVE-2017-16943
- advisoryhttps://www.cve.org/CVERecord?id=CVE-2017-16943
- advisoryhttps://blog.qualys.com/vulnerabilities-research/2021/05/04/21nails-multiple-vulnerabilities-in-exim-mail-server
- advisoryhttps://blog.qualys.com/vulnerabilities-research/2021/05/04/21nails-multiple-vulnerabilities-in-exim-mail-server/
- advisoryhttps://blog.qualys.com/vulnerabilities-research/2021/05/04/21nails-multiple-vulnerabilities-in-exim-mail-server?utm_source=dlvr.it&utm_medium=twitter
Description
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.
Affected Products
63 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| EximExim | 4.88, 4.89 | 4.89.1-1 |
| Debian LinuxDebian | 9.0 | n/a |
| exim4debian | See advisory | 4.89-12 |
| exim-greylistamazon | See advisory | 4.89-4.17.amzn1 |
| exim-monamazon | See advisory | 4.89-4.17.amzn1 |
Patched Releases
Exim
4.86.2-17.1, 4.89-4.17.amzn1, 4.89-r7, 4.89.1-1, 4.94.2-4.2, 4.94.2-bp151.2.4.1, 4.94.2-bp152.6.4.1, 4.94.2-lp152.8.3.1
exim-greylist
4.89-4.17.amzn1
exim-mon
4.89-4.17.amzn1
exim-mysql
4.89-4.17.amzn1
exim-pgsql
4.89-4.17.amzn1
exim4
4.89-12, 4.89-2+deb9u2
eximon
4.86.2-17.1, 4.94.2-4.2, 4.94.2-bp151.2.4.1, 4.94.2-bp152.6.4.1, 4.94.2-lp152.8.3.1
eximstats-html
4.86.2-17.1, 4.94.2-4.2, 4.94.2-bp151.2.4.1, 4.94.2-bp152.6.4.1, 4.94.2-lp152.8.3.1
libspf2-2
1.2.10-bp151.4.1, 1.2.10-bp152.5.1
libspf2-devel
1.2.10-bp151.4.1, 1.2.10-bp152.5.1
libspf2-tools
1.2.10-bp151.4.1, 1.2.10-bp152.5.1
Timeline
Publicly disclosed
May 5, 2021
Last updated
Aug 4, 2026
Weakness Type
- CWE-416 Use After Free
References
- advisorysecurity-tracker.debian.org · CVE-2017-16943
- advisoryubuntu.com · CVE-2017-16943
- advisorycve.org · CVERecord
- advisoryblog.qualys.com · 21nails-multiple-vulnerabilities-in-exim-mail-s…
- advisoryblog.qualys.com · 21nails-multiple-vulnerabilities-in-exim-mail-s…
FAQ
Common Questions.
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.
Affected: Exim versions 4.88, 4.89; Debian Linux versions 9.0; exim4 (debian), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Exim 4.86.2-17.1, Exim 4.89-4.17.amzn1, Exim 4.89-r7.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Is CVE-2017-16943 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo