Loading vulnerability…
Out-of-Bounds Read in Exim UTF-8 Header Processing
CVE-2026-40686 is an out-of-bounds read vulnerability in Exim versions before 4.99.2. In configurations that enable UTF-8 operators, processing malformed UTF-8 header data containing large trailing characters can cause an out-of-bounds read. If error messages are required while handling subsequent messages on the same connection and similarly malformed headers are present, the condition may disclose data in an error message.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The vulnerability may disclose information through an error message generated while handling an unrelated subsequent email message on the same connection. The disclosed data may originate from memory accessed outside the intended bounds.
If you can’t patch tonight, do this now.
Refer to the Exim security bulletin dated 2026-04-29 and install the available updates.
Patch, then assume compromise.
Upgrade Exim to version 4.99.2 or later by applying the updates referenced in the Exim security bulletin dated 2026-04-29.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.