Exim before version 4.100.1, when configured to use Proxy-Protocol with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory. This is an information disclosure vulnerability that can leak sensitive data. The CVSS 3.1 base score is 7.5, with network attack vector, high attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. The vulnerability affects multiple Ubuntu-specific Exim4 package versions as listed. No known exploits are reported in the wild.

Attackers can remotely read uninitialized stack memory data when Proxy-Protocol is used with a malicious proxy, potentially exposing sensitive information. The vulnerability does not allow attackers to modify data or cause significant denial of service but compromises confidentiality. The medium severity rating reflects the high confidentiality impact but limited integrity and availability impact.

A fix is available in Exim version 4.100.1 and later. Users should upgrade to version 4.100.1 or newer to remediate this vulnerability. Since this is not a cloud service, remediation depends on applying the vendor patch. Check the vendor or distribution advisory for official patches and update instructions. No additional mitigation steps are indicated.