Exim libspf2 Stack Buffer Overflow on Linux Mail Servers (CVE-2025-24016)

CVE-2025-24016 is a stack buffer overflow in Exim's libspf2 integration when parsing SPF macros. Linux mail servers running vulnerable Exim builds with SPF checking enabled may be remotely compromised during inbound mail processing.

Affected Exim

• Exim before 4.98.1 (verify distro package version)
• Configs with spf = yes or ACLs calling SPF lookups
• Public MX hosts on Ubuntu, Debian, AlmaLinux, etc.

Audit mail server

exim -bV | head -3
grep -i spf /etc/exim4/exim4.conf* 2>/dev/null
rpm -q exim 2>/dev/null || dpkg -l exim4

Mitigation

• Upgrade Exim from OS vendor security repository
• Temporarily disable SPF lookups in ACL if patch is pending
• Restrict relay and submission to authenticated clients
• Monitor mail logs for malformed SPF macro strings

Mail servers are high-value targets — patch before public exploit integration.