CVE-2026-40686: exim Out-of-bounds Read
CVSS: 5.3v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2026-40686DEBIAN-CVE-2026-40686CGA-46wr-pm26-8v8vCGA-562f-r7m3-58jmCGA-7x3v-634r-vfvmCGA-835m-mj9r-mg52CGA-889f-mj49-8mjrCGA-93vg-f8q7-j2xpCGA-c29h-5jcv-f5gvCGA-cp5v-grh9-rcmwCGA-cq5r-p6q5-x9q6CGA-j5jh-9mx7-vprwCGA-m667-jw67-45g6CGA-mc86-m66j-r7cmCGA-p5jh-mpxp-h5mrCGA-qp85-783j-xgx6CGA-qwpg-w2hr-62jfCGA-r677-j872-vqjfCGA-rgrh-vr6c-vrf3CGA-v22g-jh8v-fw8jCGA-wcv8-wp9g-xp2jCGA-wvm5-c98p-r35f
Published 30-04-2026Last modified 01-05-2026
Vulnerability summary
CVE-2026-40686 is a medium (CVSS 5.3) Out-of-bounds Read vulnerability in exim. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33.1% of scored vulnerabilities.
CVSS score
5.3/10
010
Medium · v3.1 (NVD)EPSS score
0.40%
0%100%
Low · +0.16 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 3Timeline
- 30-04-2026PublishedVulnerability first disclosed.
- 01-05-2026Last modifiedVulnerability information updated.
Description
In Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characters are present (malformed UTF-8 header data). Information might be divulged within an error message produced during handling of an unrelated e-mail message.
CVSS metrics
4 scores · 4 sources · 1 versionMedium 5.3Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSources4 sources · 3.7–5.3
- CVE.orgCNA3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
33%
Versus all other CVEs
30-day change
+0.16 pp
From 0.25% on 19-09-2026
19-09-202619-10-2026
EPSS score0.40%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard10 products
- exim< 4.99.5-r0
- exim-cdb< 4.99.5-r0
- exim-dbmdb< 4.99.5-r0
- exim-dnsdb< 4.99.5-r0
- exim-doc< 4.99.5-r0
Wolfi10 products
- exim< 4.99.5-r0
- exim-cdb< 4.99.5-r0
- exim-dbmdb< 4.99.5-r0
- exim-dnsdb< 4.99.5-r0
- exim-doc< 4.99.5-r0
Debian1 product
- exim4< 4.96-15+deb12u9 | < 4.98.2-1+deb13u2 | < 4.99.2-1
Exim1 product
- exim< 4.99.2
Ubuntu1 product
- exim4All versions (No fix recorded) | < 4.93-13ubuntu1.12+esm1 | < 4.95-4ubuntu2.7 | < 4.97-4ubuntu4.4 | < 4.98.2-1ubuntu2.1 | < 4.99.1-1ubuntu1.1
5 vendors · 23 products
