expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local…
Priority LOW 22CWE-189Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- Will not fix Red Hat: no fix planned
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-189 and the CVSS impact.
Summary
expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary commands via a crafted lookup value.
Why it matters now
EPSS 0.00487 42nd percentileScored 2026-11-07
Fix Will not fix Red Hat: no fix planned
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 52
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:* | up to 4.82.1 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.00:*:*:*:*:*:*:* | 4.00 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.01:*:*:*:*:*:*:* | 4.01 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.02:*:*:*:*:*:*:* | 4.02 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.03:*:*:*:*:*:*:* | 4.03 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.04:*:*:*:*:*:*:* | 4.04 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.05:*:*:*:*:*:*:* | 4.05 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.10:*:*:*:*:*:*:* | 4.10 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.11:*:*:*:*:*:*:* | 4.11 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.12:*:*:*:*:*:*:* | 4.12 | Vulnerable | Exim |
- cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:* Versions up to 4.82.1 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.00:*:*:*:*:*:*:* Versions 4.00 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.01:*:*:*:*:*:*:* Versions 4.01 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.02:*:*:*:*:*:*:* Versions 4.02 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.03:*:*:*:*:*:*:* Versions 4.03 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.04:*:*:*:*:*:*:* Versions 4.04 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.05:*:*:*:*:*:*:* Versions 4.05 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.11:*:*:*:*:*:*:* Versions 4.11 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.12:*:*:*:*:*:*:* Versions 4.12 Vulnerable ·Exim
Show 42 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:exim:exim:4.14:*:*:*:*:*:*:* | 4.14 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.20:*:*:*:*:*:*:* | 4.20 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.21:*:*:*:*:*:*:* | 4.21 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.22:*:*:*:*:*:*:* | 4.22 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.23:*:*:*:*:*:*:* | 4.23 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.24:*:*:*:*:*:*:* | 4.24 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.30:*:*:*:*:*:*:* | 4.30 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.31:*:*:*:*:*:*:* | 4.31 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.32:*:*:*:*:*:*:* | 4.32 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.33:*:*:*:*:*:*:* | 4.33 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.34:*:*:*:*:*:*:* | 4.34 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.40:*:*:*:*:*:*:* | 4.40 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.41:*:*:*:*:*:*:* | 4.41 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.42:*:*:*:*:*:*:* | 4.42 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.43:*:*:*:*:*:*:* | 4.43 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.44:*:*:*:*:*:*:* | 4.44 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.50:*:*:*:*:*:*:* | 4.50 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.51:*:*:*:*:*:*:* | 4.51 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.52:*:*:*:*:*:*:* | 4.52 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.53:*:*:*:*:*:*:* | 4.53 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.54:*:*:*:*:*:*:* | 4.54 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.60:*:*:*:*:*:*:* | 4.60 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.61:*:*:*:*:*:*:* | 4.61 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.62:*:*:*:*:*:*:* | 4.62 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.63:*:*:*:*:*:*:* | 4.63 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.64:*:*:*:*:*:*:* | 4.64 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.65:*:*:*:*:*:*:* | 4.65 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.66:*:*:*:*:*:*:* | 4.66 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.67:*:*:*:*:*:*:* | 4.67 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.68:*:*:*:*:*:*:* | 4.68 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.69:*:*:*:*:*:*:* | 4.69 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.70:*:*:*:*:*:*:* | 4.70 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.71:*:*:*:*:*:*:* | 4.71 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.72:*:*:*:*:*:*:* | 4.72 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.73:*:*:*:*:*:*:* | 4.73 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.74:*:*:*:*:*:*:* | 4.74 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.75:*:*:*:*:*:*:* | 4.75 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.76:*:*:*:*:*:*:* | 4.76 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.77:*:*:*:*:*:*:* | 4.77 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.80:*:*:*:*:*:*:* | 4.80 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.80.1:*:*:*:*:*:*:* | 4.80.1 | Vulnerable | Exim |
| cpe:2.3:a:exim:exim:4.82:*:*:*:*:*:*:* | 4.82 | Vulnerable | Exim |
- cpe:2.3:a:exim:exim:4.14:*:*:*:*:*:*:* Versions 4.14 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.20:*:*:*:*:*:*:* Versions 4.20 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.21:*:*:*:*:*:*:* Versions 4.21 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.22:*:*:*:*:*:*:* Versions 4.22 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.23:*:*:*:*:*:*:* Versions 4.23 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.24:*:*:*:*:*:*:* Versions 4.24 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.30:*:*:*:*:*:*:* Versions 4.30 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.31:*:*:*:*:*:*:* Versions 4.31 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.32:*:*:*:*:*:*:* Versions 4.32 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.33:*:*:*:*:*:*:* Versions 4.33 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.34:*:*:*:*:*:*:* Versions 4.34 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.40:*:*:*:*:*:*:* Versions 4.40 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.41:*:*:*:*:*:*:* Versions 4.41 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.42:*:*:*:*:*:*:* Versions 4.42 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.43:*:*:*:*:*:*:* Versions 4.43 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.44:*:*:*:*:*:*:* Versions 4.44 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.50:*:*:*:*:*:*:* Versions 4.50 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.51:*:*:*:*:*:*:* Versions 4.51 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.52:*:*:*:*:*:*:* Versions 4.52 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.53:*:*:*:*:*:*:* Versions 4.53 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.54:*:*:*:*:*:*:* Versions 4.54 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.60:*:*:*:*:*:*:* Versions 4.60 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.61:*:*:*:*:*:*:* Versions 4.61 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.62:*:*:*:*:*:*:* Versions 4.62 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.63:*:*:*:*:*:*:* Versions 4.63 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.64:*:*:*:*:*:*:* Versions 4.64 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.65:*:*:*:*:*:*:* Versions 4.65 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.66:*:*:*:*:*:*:* Versions 4.66 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.67:*:*:*:*:*:*:* Versions 4.67 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.68:*:*:*:*:*:*:* Versions 4.68 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.69:*:*:*:*:*:*:* Versions 4.69 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.70:*:*:*:*:*:*:* Versions 4.70 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.71:*:*:*:*:*:*:* Versions 4.71 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.72:*:*:*:*:*:*:* Versions 4.72 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.73:*:*:*:*:*:*:* Versions 4.73 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.74:*:*:*:*:*:*:* Versions 4.74 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.75:*:*:*:*:*:*:* Versions 4.75 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.76:*:*:*:*:*:*:* Versions 4.76 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.77:*:*:*:*:*:*:* Versions 4.77 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.80:*:*:*:*:*:*:* Versions 4.80 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.80.1:*:*:*:*:*:*:* Versions 4.80.1 Vulnerable ·Exim
- cpe:2.3:a:exim:exim:4.82:*:*:*:*:*:*:* Versions 4.82 Vulnerable ·Exim
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2014-2972
- 2026-10-03 Alias added: GHSA-9qqj-vrhc-8q74
References
Advisory 5
More Exim vulnerabilities
- TI-2019-12627 Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than… KEVCVSS 3.1CRITICAL 9.8
- TI-2019-07471 OS command injection in exim KEVCVSS 3.1CRITICAL 9.8
- TI-2018-04965 An issue was discovered in the base64d function in the SMTP listener in Exim before… KEVCVSS 3.1CRITICAL 9.8
- TI-2010-04077 Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70… KEVCVSS 3.1CRITICAL 9.8
- TI-2010-04078 Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of… KEVCVSS 3.1HIGH 7.8
- TI-2025-19707 SQL injection in Exim CVSS 3.1CRITICAL 9.8
Sources
- CVE-2014-2972 · CVE Program
- CVE-2014-2972 · NVD
- FIRST EPSS
- GHSA-9qqj-vrhc-8q74 · GitHub Advisory Database · CC BY 4.0
- CVE-2014-2972 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences