This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Exim fixes 4 vulnerabilities
Exim fixes 4 vulnerabilities in version 4.99.2. The most severe of them are described below; the rest can be found at [1].
An unauthenticated remote attacker can write outside the bounds of allocated memory by sending an e-mail with a specially crafted header containing invalid JSON data. The vulnerability is exploitable if JSON lookup is enabled [1][2].
The vulnerability is present in product:
- Exim; <4.99.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-40685 at cve.org, NVD
- CWE-787: Out-of-bounds Write at cwe.mitre.org
The vulnerability was publicly disclosed 30. 4. 2026.
An unauthenticated remote attacker can, by initiating the authentication process via the SPA driver with specially crafted data, cause the connection to crash or read potentially sensitive data from uninitialized heap memory [1][3].
The vulnerability is present in product:
- Exim; <4.99.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
More information:
- CVE-2026-40687 at cve.org, NVD
- CWE-909: Missing Initialization of Resource at cwe.mitre.org
The vulnerability was publicly disclosed 30. 4. 2026.
Links
By CESNET, z.s.p.o. Michaela Ručková on 4. 5. 2026.