CVE-2026-40686
In Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characters are present (malformed UTF-8 header data). Information might be divulged within an error message produced during handling of an unrelated e-mail message.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40686?
CVE-2026-40686 is classified as a medium severity vulnerability due to its potential to disclose information via error messages.
How do I fix CVE-2026-40686?
To fix CVE-2026-40686, upgrade Exim to version 4.99.2 or later to eliminate the out-of-bounds read vulnerability.
What causes CVE-2026-40686?
CVE-2026-40686 is caused by handling large malformed UTF-8 trailing characters in email header data when utf8 operators are enabled.
Which versions of Exim are affected by CVE-2026-40686?
Exim versions prior to 4.99.2 are affected by CVE-2026-40686.
What type of information could be leaked by CVE-2026-40686?
CVE-2026-40686 could potentially leak information within error messages generated during the processing of unrelated email messages.