Exim Out-of-Bounds Heap Write Vulnerability in JSON Lookup

A vulnerability in Exim versions prior to 4.99.2 allows for an out-of-bounds heap write when JSON lookup is enabled. This issue arises from an incorrect implementation of unescaping JSON, which can lead to heap corruption when a JSON operator processes malformed JSON in an untrusted header.

Impact

Exploitation of this vulnerability can cause remote-triggered heap corruption, potentially leading to arbitrary code execution.

Reproduction

To reproduce this vulnerability, configure Exim to use JSON lookup with operators that can process external input. Then, send an email with a header that includes crafted JSON data, deliberately malformed to exploit the unescaping flaw. This will trigger the out-of-bounds write, corrupting the heap.

Remediation

Users can upgrade to Exim version 4.99.2, available as a tarball from the Exim FTP server or directly from Git. Instructions for verifying the release signature are also provided.