CVE-2026-40687

The record

In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.

Affected packages

Related vulnerabilities

• CVE-2026-113351 libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because… CWE-909
• CVE-2026-43040 In the Linux kernel, the following vulnerability has been resolved: net: ipv6: ndisc: fix… CWE-909
• CVE-2022-1016 A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain… CWE-909
• CVE-2022-0382 An information leak flaw was found due to uninitialized memory in the Linux kernel's TIPC… CWE-909
• CVE-2021-29980 Uninitialized memory in a canvas object could have caused an incorrect free() leading to… CWE-909
• CVE-2021-23994 A WebGL framebuffer was not initialized early enough, resulting in memory corruption and… CWE-909
• CVE-2021-34693 net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive… CWE-909
• CVE-2021-22898 curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line… CWE-909