CVE-2026-40687: Critical severity Exim Exim vulnerability
Published Apr 30, 2026
·Updated
In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.
Affected Software
2 affected components
Exim Exim<4.99.2
Exim Exim<4.99.2
Remediation
Event History
Apr 30, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-40687?
CVE-2026-40687 is considered a critical vulnerability due to its potential to crash connections and leak sensitive data.
2
How do I fix CVE-2026-40687?
To fix CVE-2026-40687, upgrade Exim to version 4.99.2 or later.
3
What software is affected by CVE-2026-40687?
CVE-2026-40687 affects Exim versions prior to 4.99.2.
4
What kind of vulnerability is CVE-2026-40687?
CVE-2026-40687 is an out-of-bounds write vulnerability that can lead to crashes or data leaks.
5
Is CVE-2026-40687 exploitable remotely?
Yes, CVE-2026-40687 can be exploited remotely through adversarial SPA resources.