Unauthenticated code execution via recipient-count overflow

Integer overflow in Exim before 4.94.2 allows remote attackers to execute code as the Exim user through excessive SMTP recipients. In receive_add_recipient(), doubling recipients_list_max and multiplying it by recipient_item size wraps the allocation size negative after 52,428,800 recipients, then memcpy writes nearly 2 GB beyond the block. Remote exploitation requires over 25 GB of memory in the default configuration, while Exim 4.94 adds quadratic taint-checking work that can take months.