CVE-2026-40684

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-40684
In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.

5.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://code.exim.org/exim/exim/commit/628bbaca7672748d941a12e7cd5f0122a4e18c81 Patch
https://exim.org/static/doc/security/CVE-2026-40684.txt Broken Link
https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40684.assessment Vendor Advisory
https://www.openwall.com/lists/oss-security/2026/04/30/21 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/05/01/11
Configurations

Configuration 1 (hide)

cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*
History

01 May 2026, 18:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/05/01/11 -

01 May 2026, 17:51

Type Values Removed Values Added
CPE cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*
First Time Exim
Exim exim
References () https://code.exim.org/exim/exim/commit/628bbaca7672748d941a12e7cd5f0122a4e18c81 - () https://code.exim.org/exim/exim/commit/628bbaca7672748d941a12e7cd5f0122a4e18c81 - Patch
References () https://exim.org/static/doc/security/CVE-2026-40684.txt - () https://exim.org/static/doc/security/CVE-2026-40684.txt - Broken Link
References () https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40684.assessment - () https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40684.assessment - Vendor Advisory
References () https://www.openwall.com/lists/oss-security/2026/04/30/21 - () https://www.openwall.com/lists/oss-security/2026/04/30/21 - Mailing List, Third Party Advisory

01 May 2026, 02:16

Type Values Removed Values Added
References
  • {'url': 'https://exim.org/static/doc/security/CVE-2025-40684.txt', 'source': 'cve@mitre.org'}
  • () https://exim.org/static/doc/security/CVE-2026-40684.txt -

30 Apr 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-30 22:16

Updated : 2026-05-01 18:16

NVD link : CVE-2026-40684

Mitre link : CVE-2026-40684

CVE.ORG link : CVE-2026-40684

JSON object : View

Products Affected

exim

  • exim
CWE
CWE-684

Incorrect Provision of Specified Functionality