Every CVESearch/Get API key

CVE-2025-26794

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL...

7.5 HighPublic exploitFix available

CVE-2025-26794 is a high vulnerability (CVSS 7.5) in Exim, published February 21, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 77.6%, the 99th percentile. Fixed in exim4 4.98-4.

What does this mean?
Severity
7.5 HighCVSS 3.1, CVE List
Exploit chance
77.6%EPSS, 99th percentile
Exploitation
None known3 public exploits
Fixed in
4.98-4exim4 +2 more

Description

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

77.6%Up 77.6 points since Feb 22, 2025
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
exim4
Debian:13
before 4.98-4
4.98-4
exim4
Debian:14
before 4.98-4
4.98-4
exim
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
before 4.98.2-1.1
4.98.2-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubOscarBataille/CVE-2025-267942025-02-22
PoC in GitHubishwardeepp/CVE-2025-26794-Exim-Mail-SQLi2025-03-05
PoC in GitHubXploitGh0st/CVE-2025-26794-exploit2025-10-31

What each source reports

CVE List Score used7.5

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)

Record
CVE-2025-26794
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-89
Updated
2026-11-02
EUVDEUVD-2025-44517.5

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)

Record
EUVD-2025-4451
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-v8m7-99rg-xp5c7.5

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL...

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection.

Record
GHSA-v8m7-99rg-xp5c
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-89
Updated
2026-11-02
NVD7.5

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)

Record
CVE-2025-26794
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
OSV7.5

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)

Record
CVE-2025-26794
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-89
Updated
2026-11-02
OSVDEBIAN-CVE-2025-267949.8

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)

Record
DEBIAN-CVE-2025-26794
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-267947.5

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection.

Record
UBUNTU-CVE-2025-26794
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2025:14935-1No score

exim-4.98.2-1.1 on GA media

These are all security issues fixed in the exim-4.98.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14935-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, exploits, facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 14 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open