Exim 4.88 through 4.99.4 mishandles certain short payloads when operating behind proxy configurations, causing uninitialized stack memory values to be sent back to the remote client. As a result, an attacker can obtain arbitrary, uninitialized data from the Exim process, leading to a partial information disclosure that could reveal sensitive credentials or configuration details. The weakness is categorized as CWE-839.

Vendors affected include Exim. Product Exim version 4.88 up to but not including 4.99.4 are vulnerable. Any deployments of Exim in proxy mode that accept short payloads from external sources fall within the scope.

With a CVSS score of 5.3 the vulnerability presents a moderate risk. The exposure of uninitialized stack data results in a moderate confidentiality impact, and no denial of service or execution capability is noted. Because the attack requires traffic to pass through a misconfigured proxy, an external attacker can trigger the exploit remotely. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation activity has not yet been observed at scale.