Loading vulnerability…
Out-of-Bounds Heap Write in Exim JSON Lookup
CVE-2026-40685 is an out-of-bounds heap-write vulnerability in Exim before version 4.99.2. In configurations with JSON lookup enabled, incorrect handling of escaped backslashes can cause a JSON operator to perform out-of-bounds memory operations when it processes malformed JSON in an untrusted message header. The condition can corrupt heap memory and may also involve an out-of-bounds read.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause heap corruption. Remote unauthenticated attackers may be able to cause denial of service or disclose sensitive information.
If you can’t patch tonight, do this now.
Install the available Exim security updates. Until upgrade, review configurations that enable JSON lookup or JSON operators on externally supplied headers and avoid processing malformed or untrusted JSON through those operators where operationally feasible.
Patch, then assume compromise.
Upgrade Exim to version 4.99.2 or later and apply the updates in the Exim security bulletin dated 2026-04-29.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.