Critical Exim Vulnerabilities in Ubuntu Allow Local Privilege Escalation

Multiple vulnerabilities were identified in Exim, a mail transport agent, affecting Ubuntu systems. Local attackers can exploit these flaws to access files outside the spool area and escalate privileges through improper command line handling and string expansion in .local files. The vulnerabilities impact several versions of Ubuntu, including 26.04 LTS, 24.04 LTS, and 22.04 LTS. Affected package versions include exim4 4.99.1-1ubuntu1.4 for 26.04 LTS, exim4 4.97-4ubuntu4.7 for 24.04 LTS, and exim4 4.95-4ubuntu2.11 for 22.04 LTS. Users are advised to perform a standard system update to mitigate these issues. The vulnerabilities were disclosed in Ubuntu Security Notice USN-8590-1, published on July 22, 2026.

Key Points: • Exim vulnerabilities allow local attackers to escalate privileges and access sensitive files. • Affected Ubuntu versions include 26.04, 24.04, and 22.04 LTS with specific package versions. • Users are urged to update their systems to mitigate these vulnerabilities.