CVE-2026-40687

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-40687
In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.

4.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://code.exim.org/exim/exim/commit/68b963b9f75ca27b38e1c0f8c87037990199f505 Patch
https://exim.org/static/doc/security/CVE-2026-40687.txt Broken Link
https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40687.assessment Vendor Advisory
https://www.openwall.com/lists/oss-security/2026/04/30/21 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*
History

01 May 2026, 19:17

Type Values Removed Values Added
First Time Exim
Exim exim
CPE cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*
References () https://code.exim.org/exim/exim/commit/68b963b9f75ca27b38e1c0f8c87037990199f505 - () https://code.exim.org/exim/exim/commit/68b963b9f75ca27b38e1c0f8c87037990199f505 - Patch
References () https://exim.org/static/doc/security/CVE-2026-40687.txt - () https://exim.org/static/doc/security/CVE-2026-40687.txt - Broken Link
References () https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40687.assessment - () https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40687.assessment - Vendor Advisory
References () https://www.openwall.com/lists/oss-security/2026/04/30/21 - () https://www.openwall.com/lists/oss-security/2026/04/30/21 - Mailing List, Third Party Advisory

01 May 2026, 02:16

Type Values Removed Values Added
References
  • {'url': 'https://exim.org/static/doc/security/CVE-2025-40687.txt', 'source': 'cve@mitre.org'}
  • () https://exim.org/static/doc/security/CVE-2026-40687.txt -

30 Apr 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-30 22:16

Updated : 2026-05-01 19:17

NVD link : CVE-2026-40687

Mitre link : CVE-2026-40687

CVE.ORG link : CVE-2026-40687

JSON object : View

Products Affected

exim

  • exim
CWE
CWE-909

Missing Initialization of Resource