Skip to content
Fencer Intel
high 7.0

CVE-2016-1531 json

Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.

published 2016-04-07 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-2626

cvss
7.0
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
6.2%
EPSS 6.2% chance of exploitation in 30 days, percentile 93%
public exploits
4
Metasploit, Exploit-DB

Summary

Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.

Patch / fix

  • exim4 Debian 14, Debian 13, Debian 12 4.86.2-1

debian advisories DEBIAN-CVE-2016-1531

  • exim4 Ubuntu 14.04 LTS 4.82-3ubuntu2.1

ubuntu advisories UBUNTU-CVE-2016-1531

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • exim openSUSE Tumbleweed 4.86.2-2.2

opensuse advisories openSUSE-SU-2024:10017-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-1531 updated cvss 6.9

exim: local root privilege escalation for configurations with perl_startup

  • Red Hat Enterprise Linux 4 exim Red Hat Enterprise Linux 5 exim
    affected: no fix planned “Will not fix”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (EDB-39535)
  2. Published

Exploit prediction

6.24% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit exploit/unix/local/exim_perl_startup Exim "perl_startup" Privilege Escalation metasploit exploit, excellent rank, 2016-03-10
  • EDB-39702 Exim - 'perl_startup' Local Privilege Escalation (Metasploit) local, 2016-04-15
  • EDB-39549 Exim < 4.86.2 - Local Privilege Escalation local, 2016-03-10
  • EDB-39535 Exim 4.84-3 - Local Privilege Escalation local, 2016-03-09
  • packetstormsecurity.com http://packetstormsecurity.com/files/136124/Exim-4.84-3-Local-Root-Privilege-Escalation.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 7.0 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.