CVE-2023-42118
Exim libspf2 Integer Underflow Remote Code Execution Vulnerability
Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-17578.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Exim libspf2 Integer Underflow Remote Code Execution Vulnerability
Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-17578.
- Record
CVE-2023-42118- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-191
- Updated
- 2026-11-02
EUVDEUVD-2023-46577
Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-17578.
- Record
EUVD-2023-46577- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2vq7-8vvf-w66v
Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows...
Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-17578.
- Record
GHSA-2vq7-8vvf-w66v- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-191
- Updated
- 2026-11-02
NVD
Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-17578.
- Record
CVE-2023-42118- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-191
- Updated
- 2026-11-02
OSVALPINE-CVE-2023-42118
Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-17578.
- Record
ALPINE-CVE-2023-42118- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-17578.
- Record
CVE-2023-42118- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2023-42118
Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-17578.
- Record
DEBIAN-CVE-2023-42118- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-2584
libspf2 security update
libspf2 is an implementation of the SPF (Sender Policy Framework) specification as found at: http://www.ietf.org/internet-drafts/draft-mengwong-spf-00.txt SPF allows email systems to check SPF DNS records and make sure that an email is authorized by the administrator of the domain name that it is coming from. This prevents email forgery, commonly used by spammers, scammers, and email viruses/worms.
Security Fix(es):
Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-17578.(CVE-2023-42118)
- Record
OESA-2024-2584- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-2585
libspf2 security update
libspf2 is an implementation of the SPF (Sender Policy Framework) specification as found at: http://www.ietf.org/internet-drafts/draft-mengwong-spf-00.txt SPF allows email systems to check SPF DNS records and make sure that an email is authorized by the administrator of the domain name that it is coming from. This prevents email forgery, commonly used by spammers, scammers, and email viruses/worms.
Security Fix(es):
Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-17578.(CVE-2023-42118)
- Record
OESA-2024-2585- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-2586
libspf2 security update
libspf2 is an implementation of the SPF (Sender Policy Framework) specification as found at: http://www.ietf.org/internet-drafts/draft-mengwong-spf-00.txt SPF allows email systems to check SPF DNS records and make sure that an email is authorized by the administrator of the domain name that it is coming from. This prevents email forgery, commonly used by spammers, scammers, and email viruses/worms.
Security Fix(es):
Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-17578.(CVE-2023-42118)
- Record
OESA-2024-2586- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-1077
libspf2 security update
libspf2 is an implementation of the SPF (Sender Policy Framework) specification as found at: http://www.ietf.org/internet-drafts/draft-mengwong-spf-00.txt SPF allows email systems to check SPF DNS records and make sure that an email is authorized by the administrator of the domain name that it is coming from. This prevents email forgery, commonly used by spammers, scammers, and email viruses/worms.
Security Fix(es):
Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-17578.(CVE-2023-42118)
- Record
OESA-2025-1077- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-42118
Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-17578.
- Record
UBUNTU-CVE-2023-42118- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libspf2Alpine:v3.18 |
before 1.2.11-r3 | 1.2.11-r3 |
libspf2Alpine:v3.19 |
before 1.2.11-r3 | 1.2.11-r3 |
libspf2Alpine:v3.20 |
before 1.2.11-r3 | 1.2.11-r3 |
libspf2Alpine:v3.21 |
before 1.2.11-r3 | 1.2.11-r3 |
libspf2Alpine:v3.22 |
before 1.2.11-r3 | 1.2.11-r3 |
libspf2Alpine:v3.23 |
before 1.2.11-r3 | 1.2.11-r3 |
libspf2Alpine:v3.24 |
before 1.2.11-r3 | 1.2.11-r3 |
libspf2Debian:12 |
All versions, plus listed versions 1.2.10-101.2.10-111.2.10-7.21.2.10-81.2.10-8.1 Show 5 moreShow less1.2.10-8.1~exp11.2.10-8.21.2.10-8.31.2.10-8.41.2.10-9 |
None known |
libspf2Debian:13 |
All versions, plus listed versions 1.2.10-101.2.10-111.2.10-8.31.2.10-8.41.2.10-9 |
None known |
libspf2Debian:14 |
All versions, plus listed versions 1.2.10-101.2.10-111.2.10-8.31.2.10-8.41.2.10-9 |
None known |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libspf2openEuler:22.03-LTS-SP4 |
before 1.2.11-2.oe2203sp4 | 1.2.11-2.oe2203sp4 |
libspf2openEuler:22.03-LTS-SP3 |
before 1.2.11-2.oe2203sp3 | 1.2.11-2.oe2203sp3 |
libspf2openEuler:24.03-LTS |
before 1.2.11-2.oe2403 | 1.2.11-2.oe2403 |
libspf2openEuler:24.03-LTS-SP1 |
before 1.2.11-2.oe2403sp1 | 1.2.11-2.oe2403sp1 |
exim4Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 4.80-7ubuntu34.80-7ubuntu44.80-9ubuntu14.80-9ubuntu24.82-3ubuntu1 Show 13 moreShow less4.82-3ubuntu24.82-3ubuntu2.14.82-3ubuntu2.24.82-3ubuntu2.34.82-3ubuntu2.44.82-3ubuntu2.4+esm14.82-3ubuntu2.4+esm24.82-3ubuntu2.4+esm34.82-3ubuntu2.4+esm44.82-3ubuntu2.4+esm64.82-3ubuntu2.4+esm74.82-3ubuntu2.4+esm84.82-3ubuntu2.4+esm9 |
None known |
exim4Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 4.86-3ubuntu14.86-7ubuntu14.86-7ubuntu24.86-7ubuntu34.86.2-2ubuntu1 Show 15 moreShow less4.86.2-2ubuntu24.86.2-2ubuntu2.14.86.2-2ubuntu2.24.86.2-2ubuntu2.34.86.2-2ubuntu2.44.86.2-2ubuntu2.54.86.2-2ubuntu2.64.86.2-2ubuntu2.6+esm14.86.2-2ubuntu2.6+esm24.86.2-2ubuntu2.6+esm44.86.2-2ubuntu2.6+esm54.86.2-2ubuntu2.6+esm64.86.2-2ubuntu2.6+esm74.86.2-2ubuntu2.6+esm84.86.2-2ubuntu2.6+esm9 |
None known |
libspf2Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.2.10-61.2.10-6build11.2.10-6ubuntu0.1~esm11.2.10-6ubuntu0.1~esm2 |
None known |
exim4Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.89-5ubuntu14.89-9ubuntu14.89-9ubuntu24.89-9ubuntu34.89-9ubuntu4 Show 15 moreShow less4.90.1-1ubuntu14.90.1-1ubuntu1.14.90.1-1ubuntu1.24.90.1-1ubuntu1.34.90.1-1ubuntu1.44.90.1-1ubuntu1.54.90.1-1ubuntu1.84.90.1-1ubuntu1.94.90.1-1ubuntu1.104.90.1-1ubuntu1.10+esm14.90.1-1ubuntu1.10+esm24.90.1-1ubuntu1.10+esm34.90.1-1ubuntu1.10+esm44.90.1-1ubuntu1.10+esm54.90.1-1ubuntu1.10+esm6 |
None known |
libspf2Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.2.10-7build21.2.10-7ubuntu0.18.04.1~esm1 |
None known |
exim4Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 4.92.1-1ubuntu34.92.1-1ubuntu44.93~RC2-1ubuntu14.93-9ubuntu14.93-11ubuntu1 Show 12 moreShow less4.93-12ubuntu14.93-13ubuntu14.93-13ubuntu1.14.93-13ubuntu1.54.93-13ubuntu1.64.93-13ubuntu1.74.93-13ubuntu1.84.93-13ubuntu1.94.93-13ubuntu1.104.93-13ubuntu1.114.93-13ubuntu1.124.93-13ubuntu1.12+esm1 |
None known |
libspf2Ubuntu:20.04:LTS |
All versions, plus listed versions 1.2.10-7build31.2.10-7build41.2.10-7+deb9u2build0.20.04.1 |
None known |
exim4Ubuntu:22.04:LTS |
All versions, plus listed versions 4.94.2-7ubuntu24.95-2ubuntu24.95-4ubuntu14.95-4ubuntu24.95-4ubuntu2.1 Show 11 moreShow less4.95-4ubuntu2.24.95-4ubuntu2.34.95-4ubuntu2.44.95-4ubuntu2.54.95-4ubuntu2.64.95-4ubuntu2.74.95-4ubuntu2.84.95-4ubuntu2.94.95-4ubuntu2.104.95-4ubuntu2.114.95-4ubuntu2.12 |
None known |
libspf2Ubuntu:22.04:LTS |
All versions, plus listed versions 1.2.10-7.11.2.10-7.1ubuntu1 |
None known |
exim4Ubuntu:24.04:LTS |
All versions, plus listed versions 4.96-17ubuntu24.96-17ubuntu2.14.97-3ubuntu14.97-4ubuntu14.97-4ubuntu3 Show 9 moreShow less4.97-4ubuntu44.97-4ubuntu4.14.97-4ubuntu4.24.97-4ubuntu4.34.97-4ubuntu4.44.97-4ubuntu4.54.97-4ubuntu4.64.97-4ubuntu4.74.97-4ubuntu4.8 |
None known |
libspf2Ubuntu:24.04:LTS |
All versions, plus listed versions 1.2.10-7.2build11.2.10-81.2.10-8build11.2.10-8.1ubuntu21.2.10-8.1ubuntu3 |
None known |
exim4Ubuntu:25.10 |
All versions, plus listed versions 4.98.1-1ubuntu24.98.2-1ubuntu14.98.2-1ubuntu24.98.2-1ubuntu2.14.98.2-1ubuntu2.24.98.2-1ubuntu2.3 |
None known |
libspf2Ubuntu:25.10 |
All versions, plus listed versions 1.2.10-8.3 |
None known |
exim4Ubuntu:26.10 |
All versions, plus listed versions 4.99.1-1ubuntu14.99.1-1ubuntu24.99.4-1ubuntu14.99.4-1ubuntu34.99.4-1ubuntu44.99.4-1ubuntu5 |
None known |
libspf2Ubuntu:26.10 |
All versions, plus listed versions 1.2.10-91.2.10-111.2.10-11build1 |
None known |
exim4Ubuntu:26.04:LTS |
All versions, plus listed versions 4.98.2-1ubuntu24.99-4ubuntu14.99.1-1ubuntu14.99.1-1ubuntu1.14.99.1-1ubuntu1.24.99.1-1ubuntu1.34.99.1-1ubuntu1.44.99.1-1ubuntu1.5 |
None known |
libspf2Ubuntu:26.04:LTS |
All versions, plus listed versions 1.2.10-8.31.2.10-8.41.2.10-9 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-42118 is a high vulnerability (CVSS 7.5) in Exim Libspf2, published May 3, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.35%, the 94th percentile. Fixed in libspf2 1.2.11-r3.
References
zerodayinitiative.com/advisories/ZDI-23-1472
openwall.com/lists/oss-security/2025/03/28/1
nvd.nist.gov/vuln/detail/CVE-2023-42118
github.com/advisories/GHSA-2vq7-8vvf-w66v
security.alpinelinux.org/vuln/CVE-2023-42118
security-tracker.debian.org/tracker/CVE-2023-42118
Show 7 moreShow less
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2024-2584
ubuntu.com/security/CVE-2023-42118
exim.org/static/doc/security/CVE-2023-zdi.txt
cve.org/CVERecord?id=CVE-2023-42118