CVE-2026-66141
Description
A flaw was found in Exim. This vulnerability allows a local attacker to achieve privilege escalation due to the mishandling of force_command for a pipe transport when processing .forward files. This could enable an unprivileged user to gain elevated access on the system.
Statement
This flaw affects Exim versions 4.82 through 4.99.4. Exploitation requires a local user account capable of controlling a .forward file, on a system where Exim is configured with a redirect router that routes .forward processing to a pipe transport, where that pipe transport has the force_command option set and runs with elevated/privileged permissions. The issue is fixed upstream in Exim 4.99.5, which removes the local_part expansion under force_command. Exim is shipped only via the community Fedora and EPEL repositories, not by any supported Red Hat product. No Red Hat product streams are affected by this flaw.
Mitigation
Upgrade to Exim 4.99.5 or later. If an immediate upgrade isn't possible, remove the force_command option from any pipe transport reachable via user .forward routing, or ensure such transports do not run as a privileged user. Upstream Fedora/EPEL already ship the fixed version 4.99.5.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
