CVE-2026-40685

In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an incorrect implementation of \ skipping.

• SECURITY UPDATE: out-of-bounds read in DNS reverse-lookup escape decoding when running against musl libc
  • debian/patches/CVE-2026-40684.patch: harden string_copy_dnsdomain() to consume 1, 2, or 3 digits incrementally instead of indexing past the input string when fewer than 3 digits follow a backslash escape
  • CVE-2026-40684
• SECURITY UPDATE: out-of-bounds heap write in JSON dewrap on malformed header value ending in a trailing backslash
  • debian/patches/CVE-2026-40685.patch: only skip a backslash in dewrap() when followed by a non-NUL character
  • CVE-2026-40685
• SECURITY UPDATE: SPA authenticator out-of-bounds write and uninitialised-heap information disclosure
  • debian/patches/CVE-2026-40687.patch: zero the spa_base64_to_bits() output buffer to plug the infoleak; replace assert()-based length guards in unicodeToString(), strToUnicode(), and toString() with explicit length clamping to prevent OOB writes
  • CVE-2026-40687

• CVE-2026-40685: fix OOB heap write in dewrap() during JSON expansion

• CVE-2026-40685: fix OOB heap write in dewrap() during JSON expansion

• CVE-2026-40685: fix heap corruption when expanding malformed JSON
• CVE-2026-40687: fix heap buffer overflow and infoleak in SPA authenticator

• CVE-2026-40685: dewrap() OOB read/write on trailing backslash in JSON header
• CVE-2026-40687: SPA authenticator OOB read/write and base64 decode infoleak
• Refresh Exim-Maintainers-Keyring.asc to verify the 4.99.x release tarball signature

• CVE-2026-40685: fix OOB heap write in dewrap() when expanding header ending with stray backslash

It was discovered that Exim incorrectly handled parsing malformed JSON in message headers. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-40685)

It was discovered that Exim incorrectly handled processing of UTF-8 trailing characters. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-40686)

It was discovered that Exim incorrectly handled SPA authenticator input. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-40687)

Timo Longin discovered that Exim incorrectly handled certain SMTP messages in PIPELINING/CHUNKING configurations. A remote attacker could possibly use this issue to perform SMTP smuggling. This issue only affected Ubuntu 14.04 LTS. (CVE-2023-51766)

It was discovered that Exim incorrectly handled certain malformed JSON data in headers. A remote attacker could possibly use this issue to crash Exim, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-40685)

It was discovered that Exim incorrectly handled certain malformed UTF-8 headers. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-40686)

It was discovered that Exim incorrectly handled certain SPA resources. A remote attacker could possibly use this issue to crash Exim, resulting in a denial of service, or obtain sensitive information. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-40687)

It was discovered that Exim incorrectly handled certain CHUNKING transfers in some GnuTLS configurations. A remote attacker could possibly use this issue to crash Exim, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-45185)

Warisjeet Singh discovered that Exim incorrectly handled certain proxy connections in builds with proxy support enabled. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-48840)