Out-of-Bounds Write Vulnerability in Exim Mail Transfer Agent

CVE-2026-40687

What is CVE-2026-40687?

A vulnerability in Exim Mail Transfer Agent has been identified, where the SPA authentication driver can be exploited with malicious SPA resources. This leads to out-of-bounds write issues, which can cause the connection instance to crash. Additionally, the vulnerability poses a risk of data leakage from uninitialized heap memory, making it crucial for users to assess their exposure and apply relevant security measures immediately.

References