Out-of-bounds write in Exim - CVE-2026-40687

Vulnerability identifier: #VU130457

CSH Severity: Medium

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-40687

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read/write in the SPA authentication driver when handling a hostile or compromised external SPA/NTLM connection. A remote attacker can provide crafted SPA/NTLM responses to cause a denial of service.

The issue is exposed in configurations that use the SPA authentication driver and may also leak heap data to the instance.

Exim
Debian Linux
Gentoo Linux
Ubuntu
exim4 (Ubuntu package)
exim4-base (Ubuntu package)
exim4-daemon-heavy (Ubuntu package)
exim4-daemon-light (Ubuntu package)
exim4-dev (Ubuntu package)
eximon4 (Ubuntu package)
mail-mta/exim
exim4 (Debian package)

Install security update from vendor's website.

Exim - update to 4.99.2
exim4 (Ubuntu package) - addressed in versions 4.93-13ubuntu1.12+esm1, 4.95-4ubuntu2.7, 4.97-4ubuntu4.4, 4.98.2-1ubuntu2.1, 4.99.1-1ubuntu1.1
exim4-base (Ubuntu package) - addressed in versions 4.93-13ubuntu1.12+esm1, 4.95-4ubuntu2.7, 4.97-4ubuntu4.4, 4.98.2-1ubuntu2.1, 4.99.1-1ubuntu1.1
exim4-daemon-heavy (Ubuntu package) - update to 4.93-13ubuntu1.12+esm1
exim4-daemon-light (Ubuntu package) - update to 4.93-13ubuntu1.12+esm1
exim4-dev (Ubuntu package) - update to 4.93-13ubuntu1.12+esm1
eximon4 (Ubuntu package) - addressed in versions 4.93-13ubuntu1.12+esm1, 4.95-4ubuntu2.7, 4.97-4ubuntu4.4, 4.98.2-1ubuntu2.1, 4.99.1-1ubuntu1.1
mail-mta/exim - update to 4.99.4
exim4 (Debian package) - addressed in versions 4.96-15+deb12u9, 4.98.2-1+deb13u2

• https://www.openwall.com/lists/oss-security/2026/04/30/21
• https://lists.exim.org/lurker/message/20260429.121733.f58d9686.en.html

• Multiple vulnerabilities in Exim
• Ubuntu update for exim4
• Debian update for exim4
• Ubuntu update for exim4
• Gentoo update for Exim