CVE-2026-48840: Exim

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client.

Affected products

• Exim Exim: from 4.88, before 4.99.4 (fixed in 4.99.4)

Published 2026-05-30. Last modified 2026-07-22.