Critical Exim Mail Server Vulnerabilities Let Attackers Crash Systems

Key Takeaways

• The Exim development team has released version 4.99.2 to address four critical security flaws.
• These vulnerabilities, identified as CVE-2026-40684, CVE-2026-40685, CVE-2026-40686, and CVE-2026-40687, could lead to server crashes, memory corruption, or information leaks.
• Exim is a widely deployed mail transfer agent, making these vulnerabilities a significant concern for internet-facing email infrastructure.
• An immediate upgrade to Exim 4.99.2 is strongly recommended for all system administrators.

The Exim development team has urgently rolled out version 4.99.2 to address a quartet of recently discovered security vulnerabilities within its widely used mail server software. These critical flaws present attackers with the potential to trigger system crashes, corrupt memory, or exfiltrate sensitive data.

Given Exim’s prevalence as a leading message transfer agent across the internet, system administrators must prioritize the immediate application of this security update to safeguard their email infrastructure from potential exploitation.

Detailed Analysis of the Vulnerabilities

The latest security patch specifically targets four distinct Common Vulnerabilities and Exposures (CVEs). These issues stem from how the Exim server processes various external inputs, underscoring the importance of robust input validation.

• CVE-2026-40684: Malicious DNS Data Crash
  This vulnerability can cause a complete crash of a connection instance on systems utilizing the musl C library. It is triggered when malformed PTR records within malicious DNS data lead to an octal printing error.
• CVE-2026-40685: JSON Configuration Heap Corruption
  Attackers can exploit this flaw by providing corrupted JSON configurations that employ JSON operators on invalid external input. This can result in out-of-bounds read and write operations, directly leading to heap corruption within the server.
• CVE-2026-40686: UTF-8 Trailing Characters Data Leak
  This CVE exposes out-of-bounds read issues linked to large UTF-8 trailing characters. Processing malformed headers could inadvertently leak data, particularly if error messages are generated for subsequent emails within the same connection.
• CVE-2026-40687: SPA Authenticator Memory Issues
  This vulnerability creates out-of-bounds issues within the SPA authenticator. Connecting to a compromised external SPA or NTLM service can cause the Exim instance to crash or lead to the leakage of heap memory.

Mail servers serve as essential communication conduits for organizations globally, making them prime targets for malicious actors. Exploiting out-of-bounds read and write vulnerabilities allows attackers to manipulate a program’s memory allocation. This manipulation can enable unauthorized access to sensitive data or the overwriting of critical data, thereby disrupting normal server operations.

The DNS-related crash (CVE-2026-40684) particularly highlights how even a seemingly innocuous malformed record can instigate a denial-of-service condition for systems relying on the musl C library. Threat actors frequently deploy automated scanners to identify and target unpatched mail servers connected to the public internet, leaving these exposed endpoints highly susceptible to automated exploitation and targeted data exfiltration campaigns.

What You Should Do

• Immediate Upgrade: System administrators should prioritize upgrading their Exim installations to version 4.99.2 without delay.
• Patch Availability: The official security release is available as a tarball download from the primary Exim FTP site and can also be pulled directly from the official Exim Git repository.
• End-of-Life Versions: According to the advisory, older versions of Exim are no longer actively maintained. Organizations running legacy deployments face permanent exposure to these vulnerabilities unless they upgrade to the current branch.
• Input Validation Review: Administrators should thoroughly review their email header configurations to ensure robust validation of all externally provided JSON and UTF-8 inputs to prevent exploitation of related flaws.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.