Summary
It was discovered that Exim incorrectly handled parsing malformed JSON
in message headers. A remote attacker could possibly use this issue to
execute arbitrary code. (CVE-2026-40685)
It was discovered that Exim incorrectly handled processing of UTF-8
trailing characters. A remote attacker could possibly use this issue to
obtain sensitive information. (CVE-2026-40686)
It was discovered that Exim incorrectly handled SPA authenticator input.
An authenticated user could possibly use this issue to execute arbitrary
code. (CVE-2026-40687)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | exim4 | 4.95-4ubuntu2.7 |
| Ubuntu · 24.04 LTS 24.04:LTS | exim4 | 4.97-4ubuntu4.4 |
| Ubuntu · 25.10 | exim4 | 4.98.2-1ubuntu2.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | exim4 | 4.99.1-1ubuntu1.1 |