diff --git a/backport-CVE-2023-42115.patch b/backport-CVE-2023-42115.patch
new file mode 100644
index 0000000000000000000000000000000000000000..7fe28a5bff2eda0cfd03f39f4e017ff2698b519c
--- /dev/null
+++ b/backport-CVE-2023-42115.patch
@@ -0,0 +1,28 @@
+From 955f1203c15be96fa84b5331fa2a5cb2e556b9a9 Mon Sep 17 00:00:00 2001
+From: Jeremy Harris <jgh146exb@wizmail.org>
+Date: Thu, 11 May 2023 18:02:43 +0100
+Subject: [PATCH] Auths: fix possible OOB write in external authenticator.  Bug
+ 2999
+
+(cherry picked from commit 7bb5bc2c6592e062bf0b514cc71afd2d93e2e0dd)
+---
+ doc/doc-txt/ChangeLog    | 195 +++++++++++++++++++++++++++++++++++++++
+ src/auths/external.c |   2 +-
+ 2 files changed, 196 insertions(+), 1 deletion(-)
+
+diff --git a/src/auths/external.c b/src/auths/external.c
+index 7e7fca841..790b98159 100644
+--- a/src/auths/external.c
++++ b/src/auths/external.c
+@@ -103,7 +103,7 @@ if (expand_nmax == 0) 	/* skip if rxd data */
+ if (ob->server_param2)
+   {
+   uschar * s = expand_string(ob->server_param2);
+-  auth_vars[expand_nmax] = s;
++  auth_vars[expand_nmax = 1] = s;
+   expand_nstring[++expand_nmax] = s;
+   expand_nlength[expand_nmax] = Ustrlen(s);
+   if (ob->server_param3)
+-- 
+2.27.0
+
diff --git a/exim.spec b/exim.spec
index 5b4a45814944d5262bcbbeb52fad3ceb0568145b..3163a56032695e015312af997f3a0550fb9ea01a 100644
--- a/exim.spec
+++ b/exim.spec
@@ -4,7 +4,7 @@
 Summary:          The exim mail transfer agent
 Name:             exim
 Version:          4.96
-Release:          3
+Release:          4
 License:          GPLv2+
 Url:              https://www.exim.org/
 
@@ -43,6 +43,7 @@ Patch3:           exim-4.96-pic.patch
 Patch4:           exim-4.96-opendmarc-1.4-build-fix.patch
 # https://bugs.exim.org/show_bug.cgi?id=2899
 Patch5:           exim-4.96-build-fix.patch
+Patch6:           backport-CVE-2023-42115.patch
 
 Requires:         /etc/pki/tls/certs /etc/pki/tls/private
 Requires:         setup
@@ -482,6 +483,9 @@ fi
 %{_sysconfdir}/cron.daily/greylist-tidy.sh
 
 %changelog
+* Tue Oct 10 2023 liningjie <liningjie@xfusion.com> - 4.96-4
+- DESC:Fix CVE-2023-42115
+
 * Tue Aug 29 2023 zhuchao <tom_toworld@163.com> - 4.96-3
 - DESC:fix bug about print error message in install exim-clamav and exim-greylist