Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client.
References
| Link | Resource |
|---|---|
| https://exim.org/static/doc/security/EXIM-Security-2026-05-19.1 | Vendor Advisory |
| https://www.openwall.com/lists/oss-security/2026/05/29/3 | Mailing List Mitigation Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2026/05/29/3 | Mailing List Mitigation Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2026/06/msg00004.html |
Configurations
History
05 Jun 2026, 11:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
03 Jun 2026, 19:21
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Exim exim
Exim |
|
| CPE | cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:* | |
| References | () https://exim.org/static/doc/security/EXIM-Security-2026-05-19.1 - Vendor Advisory | |
| References | () https://www.openwall.com/lists/oss-security/2026/05/29/3 - Mailing List, Mitigation, Third Party Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/05/29/3 - Mailing List, Mitigation, Third Party Advisory |
30 May 2026, 04:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
30 May 2026, 02:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-30 02:16
Updated : 2026-06-17 10:55
NVD link : CVE-2026-48840
Mitre link : CVE-2026-48840
CVE.ORG link : CVE-2026-48840
JSON object : View
Products Affected
exim
- exim
CWE
CWE-839
Numeric Range Comparison Without Minimum Check