CVE-2026-40686 Information disclosure in Exim
An out-of-bounds read in Exim allows information disclosure via error messages when processing malformed UTF-8 headers with utf8 operators enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40686?
CVE-2026-40686 is a low-severity vulnerability in Exim Exim, published on 30 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characters are present (malformed UTF-8 header data). Information might be divulged within an error message produced during handling of an unrelated e-mail message.
Weakness: CWE-125
Which versions are affected by CVE-2026-40686?
It affects 1 product.
Products include Exim Exim.
How do I fix CVE-2026-40686?
Upgrade to a fixed version.
Is CVE-2026-40686 being exploited?
There is no known exploitation of CVE-2026-40686 in the wild and no public exploit code.
Other vulnerabilities in Exim Exim
Sources
Also known as CLSA-2026-1778690918, CLSA-2026-1780519410, DEBIAN-CVE-2026-40686, GHSA-f965-ghfw-x6jx, UBUNTU-CVE-2026-40686.