VDB
GCVE-110-CERTCC-2019-672565
GCVE-110-CERTCC-2019-672565
Advisory PublishedCVSS 10.0/10
Exim versions up to and including 4.92.1 do not properly handle trailing backslash characters in the string_interpret_escape() function. This function is used to handle peer distinguished names (DN) and Sever Name Indication (SNI) during a TLS negotiation. This vulnerability could allow a local or remote unauthenticated attacker to execute arbitrary code with root privileges.
Risk Scores
CVSS 2.0
10.0/10
Critical · AV:N/AC:L/Au:N/C:C/I:C/A:C
certcc-cam
certcc-cam
impact0population0exploitation0widely_known0score_current0ease_of_exploitation0
certcc-vrda
certcc-vrda
d1_impact4d1_population2d1_direct_report0
certcc-cvss-temporal-env
certcc-cvss-temporal-env
temporal_score7.8remediation_levelOFreport_confidenceCenvironmental_score5.86926702432target_distributionMenvironmental_vectorCDP:ND/TD:M/CR:ND/IR:ND/AR:ND
References
Browse GCVE Records
72,148 records in the GCVE database · Updated July 14, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.