CVE-2026-40684

5.9 MEDIUM

Published: April 30, 2026 Modified: May 01, 2026

Description

In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://code.exim.org/exim/exim/commit/628bbaca7672748d941a12e7cd5f0122a4e18c81

Source: cve@mitre.org

Patch

https://exim.org/static/doc/security/CVE-2026-40684.txt

Source: cve@mitre.org

Broken Link

https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40684.assessment

Source: cve@mitre.org

Vendor Advisory

https://www.openwall.com/lists/oss-security/2026/04/30/21

Source: cve@mitre.org

Mailing List Third Party Advisory

http://www.openwall.com/lists/oss-security/2026/05/01/11

Source: af854a3a-2127-422b-91ae-364da2661108

5 reference(s) from NVD

Quick Stats

CVSS v3 Score

5.9 / 10.0

EPSS (Exploit Probability)

0.1%

17th percentile

Exploitation Status

Not in CISA KEV

Weaknesses (CWE)

CWE-684

Affected Vendors

exim

Related CVEs