Title: Exim Security Advisory for EXIM-Security-2026-06-22.3 / GCVE-25-2026-07-45-3
Announced: 2026-07-22
Affects: Exim 4.82 up to and including 4.99.4
Corrected: Exim 4.99.5

Exim Security Vulnerability: EXIM-Security-2026-06-22.3
=========================================================

Identifier:   EXIM-Security-2026-06-22.3 (GCVE-25-2026-07-45-3)
Type:         Command execution with alternate privilege
Severity:     Medium
Credit:       The unnamed and uncredited authors whose works
	      were ingested as the training corpus

Timeline
--------

  2026-06-22 20:11 UTC Report received
  2026-06-23 11:57 UTC Fix drafted
  2026-07-12 12:00 UTC GCVEs assigned by [GNA](https://gcve.eu/gna/25/)
  2026-07-13 19:25 UTC Advance notice sent to distros@vs.openwall.org
  2026-07-15 11:05 UTC Fix branch and tag exim-4.99.5 pushed to exim-distros
  2025-07-22 14:00 UTC Public release

Vulnerability Summary
---------------------

A local user having a .forward file can use a string-expansion there.
With certain Exim configurations this can be used as a privilege escalation.

Affected Versions
-----------------

- Exim versions from 4.82 (2013) up to and including 4.99.4 are affected.
  The development version (master) was affected as well.
- To reach the vulnerable code, the attacker needs a local account
  on the system.
- The Exim configuration must include all of:
  - a redirect router implementing .forward facilities for local users
  - a pipe transport accessible by that router
  - the pipe transport having the "force_command" option set
  - the pipe transport configured to run as a privileged user

Mitigation
----------

Do not set "force_command" on pipe transports.

Resolution
----------

The issue is resolved in Exim version 4.99.5. All users of affected
versions are strongly encouraged to upgrade.

The fix removes, under "force_command", the expansion of a local_part
in a pipe transport.

Downloads
---------

The new version is available from the usual locations:

- https://ftp.exim.org/pub/exim/exim4/
- https://code.exim.org/exim/exim (branch exim-4.99+fixes, tag exim-4.99.5)

The release tag exim-4.99.5, signed by Jeremy Harris <jgh146exb@wizmail.org>,
key A986F3A6BD6377D8730958DEBCE58C8CE41F32DF
