High severity · published Apr 30, 2026
CVE-2026-40684
In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EX
Exim · Exim
before 4.99.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-40684
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-40684
Patch
https://code.exim.org/exim/exim/commit/628bbaca7672748d941a12e7cd5f0122a4e18c81
Broken Link
https://exim.org/static/doc/security/CVE-2026-40684.txt
Vendor Advisory
https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40684.assessment
Mailing List
https://www.openwall.com/lists/oss-security/2026/04/30/21
www.openwall.com
http://www.openwall.com/lists/oss-security/2026/05/01/11
More from Exim
9.8
CVE-2019-16928
Exim Out-of-bounds Write Vulnerability
9.8
CVE-2019-10149
Exim Mail Transfer Agent (MTA) Improper Input Validation
9.8
CVE-2018-6789
Exim Buffer Overflow Vulnerability
9.8
CVE-2010-4344
Exim Heap-Based Buffer Overflow Vulnerability
7.8
CVE-2010-4345
Exim Privilege Escalation Vulnerability