Exim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages.

published 2017-02-01 9 y ago modified 2026-06-17 4 mo ago also EUVD-2016-10748

cvss: 5.9; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 3.1%; EPSS 3.1% chance of exploitation in 30 days, percentile 87%
public exploits: 0; none known

Patch / fix

distros 4

debian ubuntu opensuse arch linux

exim4 Debian 14, Debian 13, Debian 12 4.88~RC6-2

debian advisories DEBIAN-CVE-2016-9963

exim4 Ubuntu 14.04 LTS 4.82-3ubuntu2.2
exim4 Ubuntu 16.04 LTS 4.86.2-2ubuntu2.1

ubuntu advisories UBUNTU-CVE-2016-9963

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

exim openSUSE Tumbleweed 4.94.2-4.2

opensuse advisories openSUSE-SU-2024:10746-1

exim Arch Linux 4.88-1

arch linux advisories AVG-153

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-9963 updated 2026-11-05 cvss 5.3

exim: Possible information disclosure to remote atacker

Red Hat Enterprise Linux 5 exim
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.10% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	5.9	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	2.6	AV:N/AC:H/Au:N/C:P/I:N/A:N

Classification

Weakness

CWE-320 Key Management Errors

References

debian.org /security/2016/dsa-3747
vendor-advisory, third-party-advisory
ubuntu.com /usn/USN-3164-1
vendor-advisory, third-party-advisory
exim.org /static/doc/CVE-2016-9963.txt
mitigation, vendor-advisory
bugs.exim.org /show_bug.cgi?id=1996
issue-tracking, mitigation, vendor-advisory
securitytracker.com /id/1037484
vdb-entry, third-party-advisory
securityfocus.com /bid/94947
vdb-entry, third-party-advisory

Sources

CVE List CVE-2016-9963
NVD CVE-2016-9963

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary