CVE-2026-40686

NameCVE-2026-40686
DescriptionIn Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characters are present (malformed UTF-8 header data). Information might be divulged within an error message produced during handling of an unrelated e-mail message.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-6265-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
exim4 (PTS)bullseye4.94.2-7+deb11u3vulnerable
bullseye (security)4.94.2-7+deb11u5vulnerable
bookworm, bookworm (security)4.96-15+deb12u9fixed
trixie (security), trixie4.98.2-1+deb13u2fixed
forky, sid4.99.2-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
exim4sourcebookworm4.96-15+deb12u9DSA-6265-1
exim4sourcetrixie4.98.2-1+deb13u2DSA-6265-1
exim4source(unstable)4.99.2-1

Notes

[bullseye] - exim4 <postponed> (Minor issue; can be fixed in next update)
Fixed by: https://code.exim.org/exim/exim/commit/f2570bde16fb4d4a1242ff363a4c4eecf6372efc

Search for package or bug name: Reporting problems