EUVD-2026-26445Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.
AnalysisAI
Out-of-bounds write in Exim before 4.99.2 SPA authentication driver allows remote attackers to crash the mail server connection or leak uninitialized heap memory when processing adversarial SPA authentication resources, affecting confidentiality and availability of the mail service.
Technical ContextAI
Exim's SPA (Simple Password Authentication) driver contains a buffer handling flaw (CWE-909: Missing Initialization with Hard-Coded Network Resource Configuration) when parsing SPA authentication protocol messages from remote clients. The vulnerability manifests as either an out-of-bounds write that terminates the SMTP connection or memory disclosure from uninitialized heap regions. The SPA driver is a pluggable authentication mechanism within Exim's SMTP server, making this remotely exploitable without prior authentication to the mail system.
RemediationAI
Upgrade Exim to version 4.99.2 or later, which contains the fix confirmed in the upstream commit 68b963b9f75ca27b38e1c0f8c87037990199f505 (https://code.exim.org/exim/exim/commit/68b963b9f75ca27b38e1c0f8c87037990199f505). If immediate patching is not feasible, disable the SPA authentication driver in exim.conf by removing or commenting out any SPA driver configuration in the authenticators section. This eliminates the attack surface but may require alternative authentication methods (e.g., PLAIN, LOGIN, CRAM-MD5) if SPA is relied upon by specific clients. Verify SPA is not in use before disabling it to avoid breaking legitimate authentication workflows. Consult https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40687.assessment for deployment-specific guidance.
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitr
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial
Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument. Rat
Exim mail server version 4.98 before 4.98.1 contains a remote SQL injection vulnerability when SQLite hints and ETRN ser
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Rated critical severity (CVSS 9.8), this vulnerability is re
Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM suppor
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. Rated critical sev
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. Rated critical severity (CVS
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attacke
Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_mall
Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass
Same weakness CWE-909 – Missing Initialization of Resource
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today