onyx --cves cve-2026-40687
CVE-2026-40687
- score
- <0.1
- cvss
- 4.8
- epss
- 0.7%
- published
- 2026-04-30
- kev added
- —
- first seen
Exim < 4.99.2 contains an out-of-bounds write and information disclosure caused by improper handling of adversarial SPA resources in the SPA authentication driver, letting attackers crash connections or access uninitialized heap data, exploit requires use of SPA authentication.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 5
- https://code.exim.org/exim/exim/commit/68b963b9f75ca27b38e1c0f8c87037990199f505
- https://exim.org/static/doc/security/CVE-2025-40687.txt
- https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40687.assessment
- https://www.openwall.com/lists/oss-security/2026/04/30/21
- https://exim.org/static/doc/security/CVE-2026-40687.txt