SB2026081405 - Gentoo update for Exim
Published: August 14, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2024-39929)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient validation of RFC 2231 header filename. A remote attacker can bypass a $mime_filename extension-blocking protection mechanism and deliver malicious executable files to the mailboxes.
2) Use-after-free (CVE-ID: CVE-2025-30232)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the handling of the dp command line parameter. A local user with command-line access can trigger a use-after-free error and execute arbitrary code with elevated privileges.
3) Input validation error (CVE-ID: CVE-2026-40684)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of malformed DNS data in PTR record processing when processing DNS responses on systems using musl libc. A remote attacker can provide specially crafted DNS data to cause a denial of service.
Only systems using musl libc are affected.
4) Out-of-bounds write (CVE-ID: CVE-2026-40685)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to out-of-bounds read/write in json operators when processing invalid externally-provided input in headers. A remote attacker can supply corrupt JSON data to cause memory corruption.
The issue affects configurations that use json operators on externally provided input.
5) Out-of-bounds read (CVE-ID: CVE-2026-40686)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to out-of-bounds read in utf8 operators when processing malformed utf8 in headers with large trailing characters. A remote attacker can supply malformed utf8 header data to disclose sensitive information.
Data leakage may occur if error messages are required for subsequent emails in the current connection and similar malformed headers are present.
6) Out-of-bounds write (CVE-ID: CVE-2026-40687)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds read/write in the SPA authentication driver when handling a hostile or compromised external SPA/NTLM connection. A remote attacker can provide crafted SPA/NTLM responses to cause a denial of service.
The issue is exposed in configurations that use the SPA authentication driver and may also leak heap data to the instance.
7) Use-after-free (CVE-ID: CVE-2026-45185)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to use-after-free in Exim's GnuTLS backend when handling BDAT message body transfers after a TLS close_notify alert is received before the transfer is complete. A remote attacker can send a TLS close_notify alert and then a final byte in cleartext on the same TCP connection to execute arbitrary code.
Only builds configured with USE_GNUTLS=yes are vulnerable, and exploitation requires use of the CHUNKING (BDAT) SMTP extension.
Remediation
Install update from vendor's website.