CVE-2026-40687 is an out of bounds write in the Exim SPA authentication driver, scored CVSS 4.8. An adversarial SPA resource can crash a connection or expose uninitialized heap memory. Exim 4.99.2 fixes it. Update, or disable SPA if you do not need it.
What's affected
- Affected: Exim before 4.99.2, when the SPA authentication driver is used
- Fixed: 4.99.2
The record describes two outcomes: a crash of the connection instance through an out of bounds write, or erroneous processing that reveals data from uninitialized heap memory. Exim's own page for this CVE returned not found when I fetched it, so I rely on the record here.
How to check if you're exposed
Check your version:
exim -bV
Then check whether an SPA authenticator is configured:
grep -rn "driver *= *spa" /etc/exim4 /etc/exim 2>/dev/null
No result usually means the driver is not in use in that configuration.
What to do now
- Update to Exim 4.99.2 or a distribution package that includes the fix.
- If you do not use SPA, remove the authenticator from the configuration.
- Restart Exim and confirm the version.
- Review logs for connection crashes around authentication.
Why it matters
The record maps this to CWE-909, missing initialization of a resource. Memory that was never set can hold data from earlier operations, and a write beyond a buffer can crash the process. Both come from not controlling the size and the contents of what the authentication code reads.
The score is low because attack complexity is high and the impact is limited. It is cheap to fix, and it ships with a related fix in the same release. If you run Exim on an internet facing host, use the same maintenance window for both. The record does not flag exploitation in the wild.
Quick check
Is it the same release as CVE-2026-40685?
Yes, both are fixed in Exim 4.99.2.
Sources
Last reviewed: 19 October 2026.
