CVE-2026-40687: exim Missing Initialization of Resource
CVSS: 9.1v3.1CriticalAnalyzed
AliasesUBUNTU-CVE-2026-40687DEBIAN-CVE-2026-40687CGA-6grc-8v5r-wx6hCGA-6mq4-255v-rwhxCGA-7gmh-xj9r-jp98CGA-7p2w-2c4g-px94CGA-7p47-m6vh-4fg5CGA-98p9-8xj4-7jx6CGA-cmgm-hh56-qfpmCGA-cpxw-3v6w-j7j2CGA-g3rc-mjhr-4mx6CGA-gh7g-333c-36r6CGA-gq39-xqv4-gx84CGA-h2xg-fvp9-wf45CGA-jwq3-gh32-j6xrCGA-pj67-74q5-jqg7CGA-q7p4-p7fw-6m6hCGA-qm6p-6h6g-hvc9CGA-r58c-6244-9phfCGA-w9r5-4729-wpwgCGA-x32x-xm7p-x6p6CGA-x953-x8pm-mmgp
Published 30-04-2026Last modified 01-05-2026
Vulnerability summary
CVE-2026-40687 is a critical (CVSS 9.1) Missing Initialization of Resource vulnerability in exim. EPSS estimates a 0.67% chance of exploitation in the next 30 days, higher than 51.1% of scored vulnerabilities.
CVSS score
9.1/10
010
Critical · v3.1 (NVD)EPSS score
0.67%
0%100%
Low · +0.30 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 3Timeline
- 30-04-2026PublishedVulnerability first disclosed.
- 01-05-2026Last modifiedVulnerability information updated.
Description
In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.
CVSS metrics
4 scores · 4 sources · 1 versionCritical 9.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HSources4 sources · 4.8–9.1
- CVE.orgCNA4.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
0.67%
Chance of exploitation in the next 30 days
Percentile
51%
Versus all other CVEs
30-day change
+0.30 pp
From 0.37% on 19-09-2026
19-09-202619-10-2026
EPSS score0.67%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard10 products
- exim< 4.99.5-r0
- exim-cdb< 4.99.5-r0
- exim-dbmdb< 4.99.5-r0
- exim-dnsdb< 4.99.5-r0
- exim-doc< 4.99.5-r0
Wolfi10 products
- exim< 4.99.5-r0
- exim-cdb< 4.99.5-r0
- exim-dbmdb< 4.99.5-r0
- exim-dnsdb< 4.99.5-r0
- exim-doc< 4.99.5-r0
Debian1 product
- exim4< 4.96-15+deb12u9 | < 4.98.2-1+deb13u2 | < 4.99.2-1
Exim1 product
- exim< 4.99.2
Ubuntu1 product
- exim4All versions (No fix recorded) | < 4.93-13ubuntu1.12+esm1 | < 4.95-4ubuntu2.7 | < 4.97-4ubuntu4.4 | < 4.98.2-1ubuntu2.1 | < 4.99.1-1ubuntu1.1
5 vendors · 23 products
