CVE-2026-40687

Description

In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.

PUBLISHED Reserved 2026-04-14 | Published 2026-04-30 | Updated 2026-05-01 | Assigner mitre

Problem types

CWE-909 Missing Initialization of Resource

Product status

References

www.openwall.com/lists/oss-security/2026/04/30/21

exim.org/.../security/cve-2026-04.1/CVE2026-40687.assessment

code.exim.org/...it/68b963b9f75ca27b38e1c0f8c87037990199f505

exim.org/static/doc/security/CVE-2026-40687.txt

cve.org (CVE-2026-40687)

nvd.nist.gov (CVE-2026-40687)

Download JSON