CVE-2026-40687

Katalog CVE

CVSS 9.1 · Critical EPSS 0,67%

Kerentanan Missing Initialization of Resource pada exim. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.

Rincian

Terbit di NVD

30 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-909: Missing Initialization of Resource

EPSS (30 hari)

0,67% peluang dieksploitasi; lebih tinggi dari 50,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40687.assessment advisory vendor
• https://code.exim.org/exim/exim/commit/68b963b9f75ca27b38e1c0f8c87037990199f505 patch
• https://www.openwall.com/lists/oss-security/2026/04/30/21 mailing list · advisory pihak ketiga
• https://exim.org/static/doc/security/CVE-2026-40687.txt broken link