CVE-2026-40687

Root has patched CVE-2026-40687 in the exim4 package for Root:Debian:11. Multiple fixed versions available.

In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.

• SECURITY UPDATE: out-of-bounds read in DNS reverse-lookup escape decoding when running against musl libc
  • debian/patches/CVE-2026-40684.patch: harden string_copy_dnsdomain() to consume 1, 2, or 3 digits incrementally instead of indexing past the input string when fewer than 3 digits follow a backslash escape
  • CVE-2026-40684
• SECURITY UPDATE: out-of-bounds heap write in JSON dewrap on malformed header value ending in a trailing backslash
  • debian/patches/CVE-2026-40685.patch: only skip a backslash in dewrap() when followed by a non-NUL character
  • CVE-2026-40685
• SECURITY UPDATE: SPA authenticator out-of-bounds write and uninitialised-heap information disclosure
  • debian/patches/CVE-2026-40687.patch: zero the spa_base64_to_bits() output buffer to plug the infoleak; replace assert()-based length guards in unicodeToString(), strToUnicode(), and toString() with explicit length clamping to prevent OOB writes
  • CVE-2026-40687

• CVE-2026-40687: fix uninitialized buffer and out-of-bounds writes in SPA authenticator

• CVE-2026-40687: fix uninitialized buffer and out-of-bounds writes in SPA authenticator

• CVE-2026-40685: fix heap corruption when expanding malformed JSON
• CVE-2026-40687: fix heap buffer overflow and infoleak in SPA authenticator

• CVE-2026-40685: dewrap() OOB read/write on trailing backslash in JSON header
• CVE-2026-40687: SPA authenticator OOB read/write and base64 decode infoleak
• Refresh Exim-Maintainers-Keyring.asc to verify the 4.99.x release tarball signature

• SECURITY UPDATE: heap read out-of-bounds in UTF-8 expansion
  • debian/patches/CVE-2026-40686.patch: harden ${from_utf8:} expansion operator against malformed UTF-8 trailing bytes.
  • CVE-2026-40686
• SECURITY UPDATE: SPA authenticator buffer hardening
  • debian/patches/CVE-2026-40687.patch: zero spa_base64_to_bits output buffer and replace static 1024-byte buffers in unicodeToString, strToUnicode, toString with dynamic store_get allocations sized to input.
  • CVE-2026-40687

Timo Longin discovered that Exim incorrectly handled certain SMTP messages in PIPELINING/CHUNKING configurations. A remote attacker could possibly use this issue to perform SMTP smuggling. This issue only affected Ubuntu 14.04 LTS. (CVE-2023-51766)

It was discovered that Exim incorrectly handled certain malformed JSON data in headers. A remote attacker could possibly use this issue to crash Exim, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-40685)

It was discovered that Exim incorrectly handled certain malformed UTF-8 headers. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-40686)

It was discovered that Exim incorrectly handled certain SPA resources. A remote attacker could possibly use this issue to crash Exim, resulting in a denial of service, or obtain sensitive information. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-40687)

It was discovered that Exim incorrectly handled certain CHUNKING transfers in some GnuTLS configurations. A remote attacker could possibly use this issue to crash Exim, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-45185)

Warisjeet Singh discovered that Exim incorrectly handled certain proxy connections in builds with proxy support enabled. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-48840)