Bug 2463821

Dear Exim users and maintainers,

we are pleased to announce the availability of release 4.99.2 of Exim.

This is a security release.

It fixes the following vulnerabilities.

CVE-2026-40684     Possible crash with malicious DNS data when using musl libc

  On systems using musl libc (not glibc) due to an oddity in octal printing
  it is possible to crash the connection instance when malformed DNS data
  is present in PTR records.

CVE-2026-40685     Possible OOB read/write on corrupt JSON in header

  configurations using json operators on invalid externally-provided input
  could trigger heap corruption.

CVE-2026-40686     Possible OOB read with large UTF8 trailing characters

  configurations using utf8 operators on malformed utf8 in headers could
  trigger OOB reads and might trigger some data leak if error
  messages are required for subsequent emails in the current connection
  and similar malformed headers are present.

CVE-2026-40687     Possible OOB read/write with SPA authenticator

  in configurations using the SPA authentication driver to a hostile/compromised
  external SPA/NTLM connnection it is possible to trigger an OOB read/write
  and crash the connection instance or possibly leak heap data to the instance.

Older Exim versions may or may not be vulnerable but are not actively maintained.


We would like to thank the thousands of unnamed and uncredited authors whose
works were ingested into the slopbots to "assist" in the reports for these vulnerabilities.



Exim 4.99.2 is available:

 * as tarball
   * https://ftp.exim.org/pub/exim/exim4/
   * https://code.exim.org/exim/exim/releases

 * directly from Git: https://code.exim.org/exim/exim
   tag: exim-4.99.2


The signatures on the release tarballs should be

 *  key ID 0xBCE58C8CE41F32DF
    Email: jgh