Description
In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.
Affected products
exim: exim
References5
- exim.org/static/doc/security/cve-2026-04.1/CVE2026-40684.assess… Vendor Advisory
- code.exim.org/exim/exim/commit/628bbaca7672748d941a12e7cd5f0122… Patch
- exim.org/static/doc/security/CVE-2026-40684.txt Broken Link
- www.openwall.com/lists/oss-security/2026/04/30/21 Mailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2026/05/01/11
Metrics
- CVSS 3.1
-
7.5
HIGH
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS — exploit probability
- 0% percentile: 30 · as of 13 November 2026
- CWE
- CWE-684
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.