Exim before version 4.100.1 is vulnerable to SMTP smuggling, a condition where the message received by the server does not correspond to any message actually sent by the client. This occurs because crafted data sent after a rejection during the SMTP DATA processing phase can alter the received message. The vulnerability affects many Ubuntu-specific Exim4 package versions as enumerated. The CVSS 3.1 base score is 4.0, reflecting a network attack vector with high attack complexity, no privileges required, no user interaction, scope changed, no confidentiality impact, low integrity impact, and no availability impact.

An attacker can cause the SMTP server to accept a manipulated message that differs from what was originally sent, potentially leading to message integrity issues. The vulnerability does not impact confidentiality or availability but can affect message integrity. There are no known exploits in the wild at this time.

A fixed version 4.100.1 or later addresses this vulnerability. Users should upgrade Exim to version 4.100.1 or newer to remediate this issue. Since no patch links or vendor advisory content is provided, verify the availability of official patches from the vendor or distribution maintainers. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.