CVE-2026-40685 is a heap out of bounds write in Exim, scored CVSS 6.5. When JSON lookup is enabled, malformed JSON in an untrusted header can trigger it. Exim 4.99.2 fixes it. Update, and check whether your configuration uses JSON operators on outside input.
What's affected
- Affected: Exim before 4.99.2, when JSON lookup is enabled
- Fixed: 4.99.2
The Exim project's assessment lists the condition as a configuration that uses json operators on externally provided input, and the impact as remote triggered heap corruption. The NVD text attributes the bug to an incorrect implementation of backslash skipping.
How to check if you're exposed
Check your Exim version:
exim -bV
Then check whether your configuration uses JSON operators, which appear as the extract, json style expansion operators on header values. Search the configuration:
exim -bP configure_file
grep -rn "json" /etc/exim4 /etc/exim 2>/dev/null
If nothing in the configuration applies JSON operators to header content, the stated condition is not met, though updating is still right.
What to do now
- Update Exim to 4.99.2 or your distribution backport.
- Check your configuration for JSON operators applied to header data.
- Check your distribution security tracker, since many ship patched packages without changing the upstream number.
- Restart Exim after upgrade and confirm the version.
Why it matters
The record lists CWE-787, out of bounds write, and CWE-684, incorrect provision of specified functionality. The parser mishandles an escape character while skipping through a string, so the length it computes does not match the data. That mismatch becomes a write past the end of a buffer.
Mail servers receive input from anyone, which makes parsing bugs matter even when the score is medium. The feature condition narrows exposure a lot. The record does not flag exploitation in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I affected if I never enabled JSON lookups?
The record says the issue applies when JSON lookup is enabled. Check your configuration to confirm.
Sources
- Exim security note for CVE-2026-40685 (page returned not found when I fetched it)
- Exim vulnerability assessment
- oss-security post
- Gold page for this CVE
Last reviewed: 19 October 2026.
