CVE-2026-40687

MEDIUM

Exim < 4.99.2 - Uninitialized Memory Exposure and Denial of Service via SPA Authentication Driver

Title source: llm
STIX 2.1

Description

In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.

References (5)

Core 5

Scores

CVSS v3 4.8
EPSS 0.0037
EPSS Percentile 28.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-909
Status published
Products (2)
Exim/Exim < 4.99.2
exim/exim < 4.99.2
Published Apr 30, 2026
Tracked Since May 01, 2026