cve.bz

CVE-2026-40684

7.5 highEPSS 0.4%

High (7.5) in exim exim. EPSS 0.4% chance of exploitation in the next 30 days.

In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
CWE
CWE-684
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON