CVE-2026-40687

—

CVSS 3.1

9.1 critical

EPSS

<1%p31

Published

Apr 30, 2026 (Apr 30, 2026)

Modified

Jun 17, 2026

Description

In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.

Vendors: exim
Products: exim
Weakness: CWE-909
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.