PT-2026-36198 · Exim+3 · Exim+3

Bernard Quatermass · CVE-2026-40687 · Published 2026-03-11 · Updated 2026-07-29

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions Exim versions prior to 4.99.2

Description When the SPA authentication driver is used with an adversarial SPA resource, an out-of-bounds write can occur, leading to a crash of the connection instance. Additionally, erroneous data processing may result in the disclosure of data from uninitialized heap memory.

Recommendations Update to version 4.99.2 or later.

Fix

DoS

Weakness Enumeration

CWE-909

Related Identifiers

BDU:2026-09402

CVE-2026-40687

USN-8228-1

USN-8382-1

Affected Products

Exim

Linuxmint

Red Os

Ubuntu

References · 32

• https://osv.dev/vulnerability/USN-8228-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-40687 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40687 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-09402 · Security Note
• https://ubuntu.com/security/CVE-2026-40686 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8382-1 · Vendor Advisory
• https://code.exim.org/exim/exim/commit/68b963b9f75ca27b38e1c0f8c87037990199f505 · Patch
• https://ubuntu.com/security/notices/USN-8228-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40687 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-48840 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0611SE18HF · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40687 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40687 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8382-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-40687 · Security Note