CVE-2026-40684

—

CVSS 3.1

7.5 high

EPSS

<1%p29

Published

Apr 30, 2026 (Apr 30, 2026)

Modified

Jun 17, 2026

Description

In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.

Vendors: exim
Products: exim
Weakness: CWE-684
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.