CVE-2026-40684

In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://code.exim.org/exim/exim/commit/628bbaca7672748d941a12e7cd5f0122a4e18c81	Patch
https://exim.org/static/doc/security/CVE-2026-40684.txt	Broken Link
https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40684.assessment	Vendor Advisory
https://www.openwall.com/lists/oss-security/2026/04/30/21	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/05/01/11

Configurations

Configuration 1 (hide)

cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-30 22:16

Updated : 2026-06-17 10:45

NVD link : CVE-2026-40684

Mitre link : CVE-2026-40684

CVE.ORG link : CVE-2026-40684

JSON object : View

Products Affected

exim

exim

CWE

CWE-684

Incorrect Provision of Specified Functionality

{"id": "CVE-2026-40684", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40684", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-01T14:25:46.779854Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "Exim", "product": "Exim", "versions": [{"status": "affected", "version": "0", "lessThan": "4.99.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-30T22:16:25.477", "references": [{"url": "https://code.exim.org/exim/exim/commit/628bbaca7672748d941a12e7cd5f0122a4e18c81", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://exim.org/static/doc/security/CVE-2026-40684.txt", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40684.assessment", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.openwall.com/lists/oss-security/2026/04/30/21", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/01/11", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-684"}]}], "descriptions": [{"lang": "en", "value": "In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing."}], "lastModified": "2026-06-17T10:45:34.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E48EAA99-95DA-4695-BBEA-16D09AA0A508", "versionEndExcluding": "4.99.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}