Exim CVE-2026-40686

UTF-8 operators must be explicitly enabled in the Exim configuration. This is a non-default setting-standard Exim deployments do not enable UTF-8 operators by default, so only instances with explicit utf8 operator directives or expansions in ACLs are vulnerable. The attacker must craft malformed UTF-8 headers containing large trailing characters (incomplete or oversized multi-byte sequences) that exceed the buffer size used by the UTF-8 parsing function. Default network-facing SMTP configuration is required; the vulnerability is triggered during email reception over SMTP (port 25, 587, or other configured submission ports). No authentication is required to send the malicious email. The information leak is passive and occurs only when error messages are generated during subsequent, unrelated email processing.

CVSS 3.7 with AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N indicates low-severity information disclosure with network attack vector but high complexity. The high complexity requirement (AC:H) is the primary limiting factor-the attacker must craft malformed UTF-8 headers with precise trailing character encoding to trigger the out-of-bounds read, making reliable exploitation non-trivial. No EPSS score, KEV status, or POC availability data provided, so real-world exploitation probability cannot be independently assessed. The attack produces information leakage only through error messages during unrelated email processing, limiting the confidentiality impact to accidental disclosure of transient process memory. This is a genuine but narrow vulnerability: it requires UTF-8 operators enabled (non-default in many deployments) and skillful payload construction, making it a lower-priority patch compared to network-vector RCE or authentication bypass issues, though it should be addressed during normal maintenance windows.

An attacker sends a specially crafted email message with malformed UTF-8 sequences embedded in headers (such as oversized trailing byte sequences) to an Exim server with UTF-8 operators enabled. The UTF-8 parsing code attempts to process the malformed header, reading beyond buffer boundaries and exposing nearby process memory. When Exim generates an error message in response to this email, the leaked memory contents may be appended to the error output, divulging sensitive data such as configuration values or authentication tokens from the running process. The attack succeeds only if the attacker precisely constructs the UTF-8 payload to trigger the boundary violation.