CVE-2026-40687: Exim

Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days.

In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.

Affected products

• Exim Exim: before 4.99.2 (fixed in 4.99.2)

Published 2026-04-30. Last modified 2026-06-17.