“Just over 3.5 million Exim servers are currently exposed online per a Shodan search, most of them in the United States, followed by Russia and Germany.”
ZDI reported the unauthenticated out-of-bounds write in June 2022 and resent it at Exim’s request in May 2023. When ZDI said it would go public, the reply was “you do what you do.” Exim is the default MTA on Debian and runs on 56% of reachable mail servers. Sandworm has already shown what it does with an Exim bug.