Out-of-bounds write in Exim - CVE-2026-40685

Vulnerability identifier: #VU130455

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-40685

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to out-of-bounds read/write in json operators when processing invalid externally-provided input in headers. A remote attacker can supply corrupt JSON data to cause memory corruption.

The issue affects configurations that use json operators on externally provided input.

Exim
Debian Linux
Gentoo Linux
Ubuntu
exim4 (Ubuntu package)
exim4-base (Ubuntu package)
exim4-daemon-heavy (Ubuntu package)
exim4-daemon-light (Ubuntu package)
exim4-dev (Ubuntu package)
eximon4 (Ubuntu package)
mail-mta/exim
exim4 (Debian package)

Install security update from vendor's website.

Exim - update to 4.99.2
exim4 (Ubuntu package) - addressed in versions 4.93-13ubuntu1.12+esm1, 4.95-4ubuntu2.7, 4.97-4ubuntu4.4, 4.98.2-1ubuntu2.1, 4.99.1-1ubuntu1.1
exim4-base (Ubuntu package) - addressed in versions 4.93-13ubuntu1.12+esm1, 4.95-4ubuntu2.7, 4.97-4ubuntu4.4, 4.98.2-1ubuntu2.1, 4.99.1-1ubuntu1.1
exim4-daemon-heavy (Ubuntu package) - update to 4.93-13ubuntu1.12+esm1
exim4-daemon-light (Ubuntu package) - update to 4.93-13ubuntu1.12+esm1
exim4-dev (Ubuntu package) - update to 4.93-13ubuntu1.12+esm1
eximon4 (Ubuntu package) - addressed in versions 4.93-13ubuntu1.12+esm1, 4.95-4ubuntu2.7, 4.97-4ubuntu4.4, 4.98.2-1ubuntu2.1, 4.99.1-1ubuntu1.1
mail-mta/exim - update to 4.99.4
exim4 (Debian package) - addressed in versions 4.96-15+deb12u9, 4.98.2-1+deb13u2

• https://www.openwall.com/lists/oss-security/2026/04/30/21
• https://lists.exim.org/lurker/message/20260429.121733.f58d9686.en.html

• Multiple vulnerabilities in Exim
• Ubuntu update for exim4
• Debian update for exim4
• Ubuntu update for exim4
• Gentoo update for Exim