Multiple Exim Server Vulnerabilities Let Attackers Seize Control of the Server

Researchers at NIST discovered two critical vulnerabilities in Exim 4.99 when built with SQLite hints database support: an incomplete SQL injection fix (related to CVE-2025-26794) that fails to escape single quotes, and a heap buffer overflow from unvalidated database fields used as array boundaries that can corrupt up to ~1.5 MB of heap memory. Both are remotely exploitable via SMTP under specific configurations (SQLite hints enabled and ACLs using attacker-controlled sender data); maintainers were notified, patches are recommended (escape single quotes, validate field sizes), and administrators are advised to disable SQLite hint databases or restrict related ACLs until fixes are applied.