Sploitus

CVE-2017-16944

7 known exploits for CVE-2017-16944

The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.

Affected products
Alt Linux, Exim, Suse, Ubuntu
Exim
= 4.88, 4.89
CVSS 3.0
7.5 HIGH
EPSS
42.0% (99th percentile)
Weakness
CWE-835
NVD status
Modified
Published
2017-11-25
CVE-2017-16944 at NVD
Authoritative description, scoring and affected products

7 known exploits for CVE-2017-16944

Proof-of-concept code and exploit modules indexed by Sploitus

📄 Qualys Security Advisory - Exim 21Nails Advisory
2026-02-11 Qualys Security AdvisoryPACKETSTORMPerl
📄 Exim Vulnerability Scanner
2025-12-10 indoushkaPACKETSTORMPHP
Exim 4.89 - 'BDAT' Denial of Service(CVE-2017-16944)
2017-11-29 RootSEEBUG
Exim Use-After-Free(CVE-2017-16943)
2017-11-28 RootSEEBUGPython
Exim 4.89 - 'BDAT' Denial of Service
2017-11-27 mehEXPLOITDB
Exim 4.89 Denial Of Service
2017-11-27 mehPACKETSTORM
Exim 4.89 - BDAT Denial of Service Exploit
2017-11-27 mehZDT