CVE-2026-48840mediumCWE-839

CVE-2026-48840: medium-severity vulnerability in Exim

Published · Updated

Follow this CVE+ Monitor Exim+ Monitor exim4

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.3%
In short

Exim mail server versions before 4.99.4 can leak uninitialized memory to clients in certain proxy setups when processing short payloads. This could expose sensitive data that was previously stored in the server's memory.

Technical detail

A memory disclosure vulnerability in Exim 4.88–4.99.3 occurs when specific proxy configurations process crafted short payloads, causing uninitialized stack memory to be returned to an unauthenticated client. Attack requires a susceptible proxy setup; impact is information disclosure of potentially sensitive in-memory data.

Summary generated and translated by AI from the official description.
Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Exim · Exim
Related CVEs — Exim

In the same product, most dangerous first.

CVE-2025-26794HIGHCVE-2025-26794EPSS 77.6%CVE-2023-42114LOWExim NTLM Challenge Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 27.1%CVE-2023-42115CRITICALExim AUTH Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 12.2%CVE-2023-42117HIGHExim Improper Neutralization of Special Elements Remote Code Execution VulnerabilityEPSS 6.7%CVE-2023-42116HIGHExim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 3.8%CVE-2023-42119LOWExim dnsdb Out-Of-Bounds Read Information Disclosure VulnerabilityEPSS 1.6%