CVE-2026-40684

Name: CVE-2026-40684
Creator: NVD / NIST
Published: 2026-04-30T22:16:25.477+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.5/10EPSS 0.36%

Last modified Jun 17, 2026

CVE-2026-40684 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.. EPSS estimates a 0.36% chance of exploitation in the next 30 days.

Description

In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability

0.36%

28.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-684

Affected Software

Vendor	Product	Versions
Exim	Exim	< 4.99.2

References

https://code.exim.org/exim/exim/commit/628bbaca7672748d941a12e7cd5f0122a4e18c81Patch
https://exim.org/static/doc/security/CVE-2026-40684.txtBroken Link
https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40684.assessmentVendor Advisory
https://www.openwall.com/lists/oss-security/2026/04/30/21Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/05/01/11

Timeline

Published: Apr 30, 2026
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2026-40684?

How severe is CVE-2026-40684?

CVE-2026-40684 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 0.36% probability of exploitation in the next 30 days.

How do I fix CVE-2026-40684?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-40684?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST