CVE-2016-1531

Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the...

7.0 HighPublic exploitFix available

Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

6.24%Up 3.9 points since Feb 4, 2022

What each source reports

NVD Score used 7.0

Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.

Record: CVE-2016-1531
CVSS 3.0: 7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 6.9 MediumAV:L/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.

Record: CVE-2016-1531
Updated: 2026-11-02

EUVDEUVD-2016-2626 No score

Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.

Record: EUVD-2016-2626
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qqgw-xrxj-r5fc 7.0

Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the...

Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.

Record: GHSA-qqgw-xrxj-r5fc
CVSS 3.0: 7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 7.0

Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.

Record: CVE-2016-1531
CVSS 3.0: 7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2016-1531 7.0

Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.

Record: DEBIAN-CVE-2016-1531
CVSS 3.0: 7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-1531 7.0

Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.

Record: UBUNTU-CVE-2016-1531
CVSS 3.0: 7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10017-1 No score

exim-4.86.2-2.2 on GA media

These are all security issues fixed in the exim-4.86.2-2.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10017-1
Updated: 2026-11-02

OSVUSN-2933-1 No score

exim4 vulnerabilities

It was discovered that Exim incorrectly filtered environment variables when used with the perl_startup configuration option. If the perl_startup option was enabled, a local attacker could use this issue to escalate their privileges to the root user. This issue has been fixed by having Exim clean the complete execution environment by default on startup, including any subprocesses such as transports that call other programs. This change in behaviour may break existing installations and can be adjusted by using two new configuration options, keep_environment and add_environment. (CVE-2016-1531)

Patrick William discovered that Exim incorrectly expanded mathematical comparisons twice. A local attacker could possibly use this issue to perform arbitrary file operations as the Exim user. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-2972)

Record: USN-2933-1
Updated: 2026-11-02

Affected products

exim

Affected packages

Affected packages
Package	Affected	Fixed
`exim4` Debian:12	before 4.86.2-1	4.86.2-1
`exim4` Debian:13	before 4.86.2-1	4.86.2-1
`exim4` Debian:14	before 4.86.2-1	4.86.2-1
`exim4` Debian:7	before 4.80-7+deb7u2, plus listed versions 4.80-74.80-7+deb7u1	4.80-7+deb7u2
`exim4` Debian:8	before 4.84.2-1, plus listed versions 4.84-84.84-8+deb8u14.84-8+deb8u2	4.84.2-1
`exim4` Ubuntu:14.04:LTS	before 4.82-3ubuntu2.1, plus listed versions 4.80-7ubuntu34.80-7ubuntu44.80-9ubuntu14.80-9ubuntu24.82-3ubuntu14.82-3ubuntu2	4.82-3ubuntu2.1
`exim4` Ubuntu:14.04:LTS From an advisory covering 2 CVEs	before 4.82-3ubuntu2.1, plus listed versions 4.80-7ubuntu34.80-7ubuntu44.80-9ubuntu14.80-9ubuntu24.82-3ubuntu14.82-3ubuntu2	4.82-3ubuntu2.1
`exim` openSUSE:Tumbleweed From an advisory covering 11 CVEs	before 4.86.2-2.2	4.86.2-2.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Exim 4.84-3 - Local Privilege Escalation	2016-03-09
Exploit-DB	Exim < 4.86.2 - Local Privilege Escalation	2016-03-10
Metasploit	Exim "perl_startup" Privilege Escalation	2016-03-10
Exploit-DB	Exim - 'perl_startup' Local Privilege Escalation (Metasploit)	2016-04-15
PoC in GitHub	h3x0v3rl0rd/CVE-2016-1531	2023-03-17

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, exploits, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-1531 is a high vulnerability (CVSS 7.0) in Exim, published March 2, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.24%, the 93rd percentile. Fixed in exim4 4.86.2-1.

References

Show 23 moreShow less