EUVD-2026-26443Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an incorrect implementation of \ skipping.
AnalysisAI
Out-of-bounds heap write in Exim before 4.99.2 allows unauthenticated remote attackers to cause denial of service and potentially corrupt memory when the JSON lookup feature is enabled and malformed JSON is present in untrusted email headers, due to incorrect backslash escape sequence handling in the JSON operator.
Technical ContextAI
Exim is a mail transport agent (MTA) that processes email headers and message content. The vulnerability exists in Exim's JSON lookup functionality, which parses JSON-formatted data within email processing contexts. The root cause (CWE-684: Incorrect Type Conversion or Cast) stems from improper implementation of backslash escape sequence skipping in the JSON operator-specifically, the parser fails to correctly handle malformed escape sequences, leading to out-of-bounds writes into heap memory. When JSON lookup is enabled and an untrusted email header contains specially crafted malformed JSON, the parser writes beyond allocated buffer boundaries, corrupting heap structures. The vulnerability is triggered during mail message processing, a network-facing operation in typical MTA deployments.
RemediationAI
Upgrade Exim to version 4.99.2 or later to apply the vendor-released patch. The upstream fix is confirmed by commit 9fdc057e71b87c87a0d3d2288b2810a0efaaba57 in the Exim repository. For organizations unable to patch immediately, the primary mitigation is to disable the JSON lookup feature in the Exim configuration file unless it is actively required for mail processing logic-edit the configuration to remove or comment out JSON lookup operators and restart the service. As a compensating control, restrict email routing through the vulnerable server to trusted internal sources only and implement strict rate-limiting on mail submission ports to reduce exposure window. However, these controls do not eliminate the vulnerability if JSON lookup remains enabled. Detailed assessment and patch availability information is available at https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40685.assessment and the Exim security advisory at https://exim.org/static/doc/security/CVE-2025-40685.txt.
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitr
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial
Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument. Rat
Exim mail server version 4.98 before 4.98.1 contains a remote SQL injection vulnerability when SQLite hints and ETRN ser
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Rated critical severity (CVSS 9.8), this vulnerability is re
Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM suppor
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. Rated critical sev
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. Rated critical severity (CVS
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attacke
Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_mall
Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass
Same technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today