CVE-2022-3559

What it actually does

Use-after-free condition in the Regex Handler component triggered by crafted input manipulation, resulting in memory corruption that primarily impacts availability.

Why it matters to the business

Potential denial of service against mail servers, leading to disrupted email delivery and operational downtime; low immediate risk given age and lack of known exploitation.

How an attack unfolds

An attacker sends specially crafted network traffic or messages that exercise the regex processing path, causing the use-after-free to manifest as a crash or memory corruption without further privilege escalation observed.

How to fix it

Upgrade exim/exim to commit 107077d7fd6736711bf5cd980221723401d37c51 or later; apply the referenced patch 4e9ed49f8f12eb331b29bd5b6dc3693c520fddc2 if building from source.

How to confirm the fix worked

Verify installed Exim version or commit hash against the fixed commit; review build logs and running process version strings; test regex handling paths with known-good inputs post-upgrade.

Typical attack path

1. Identify publicly reachable Exim SMTP or submission service
2. Craft and transmit input that triggers regex handler processing
3. Trigger use-after-free leading to process crash or instability
4. Repeat to sustain denial of service

How to detect it

Examine mail server logs and process crash dumps for regex-related faults around the time of service restarts; correlate with inbound SMTP traffic spikes; no public exploitation artifacts are known.

What your security team should do

• Prioritize patching Exim installations to the fixed commit within standard maintenance windows
• Monitor upstream Exim releases for any follow-on corrections
• Review mail server exposure and apply network segmentation where feasible