CVE-2026-40687

NameCVE-2026-40687
DescriptionIn Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-6265-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
exim4 (PTS)bullseye4.94.2-7+deb11u3vulnerable
bullseye (security)4.94.2-7+deb11u5vulnerable
bookworm, bookworm (security)4.96-15+deb12u9fixed
trixie (security), trixie4.98.2-1+deb13u2fixed
forky, sid4.99.2-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
exim4sourcebookworm4.96-15+deb12u9DSA-6265-1
exim4sourcetrixie4.98.2-1+deb13u2DSA-6265-1
exim4source(unstable)4.99.2-1

Notes

[bullseye] - exim4 <postponed> (Minor issue; can be fixed in next update)
Fixed by: https://code.exim.org/exim/exim/commit/68b963b9f75ca27b38e1c0f8c87037990199f505

Search for package or bug name: Reporting problems