Loading vulnerability…
Out-of-Bounds Read/Write in Exim SPA Authenticator
CVE-2026-40687 is a memory-safety vulnerability in Exim versions before 4.99.2 affecting configurations that use the SPA authentication driver. When Exim communicates with an adversarial, hostile, or compromised external SPA/NTLM resource, the authenticator can perform an out-of-bounds write or process erroneous data, potentially exposing uninitialized heap memory.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can crash the affected Exim connection instance, causing denial of service. It can also disclose data from uninitialized heap memory, potentially exposing sensitive information to the external SPA/NTLM instance.
If you can’t patch tonight, do this now.
Install the available Exim updates referenced by the security bulletin dated 2026-04-29. Until upgraded, avoid or restrict use of the SPA authentication driver with untrusted, hostile, or potentially compromised external SPA/NTLM services.
Patch, then assume compromise.
Upgrade Exim to version 4.99.2 or later by applying the updates referenced in the Exim security bulletin dated 2026-04-29.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.