CVE-2026-40685

Executive Summary

CVE-2026-40685 is a heap out-of-bounds write vulnerability in Exim mail transfer agent (MTA) versions prior to 4.99.2, specifically triggered when the JSON lookup feature is enabled and an untrusted header containing malformed JSON is processed. An unauthenticated remote attacker who can deliver or cause a crafted email message to be processed can trigger memory corruption, potentially leading to service disruption (denial-of-service) or arbitrary code execution in the context of the Exim process. This vulnerability affects the extremely widely-deployed Exim MTA, which handles a substantial portion of internet email routing, making it a high-value target for mass exploitation campaigns, particularly for botnet recruitment or spam relay operations.

Technical Analysis

The vulnerability resides within Exim's JSON lookup operator, an optional feature that allows mail administrators to extract data from JSON-formatted strings, often used in conjunction with routers, ACLs, or data lookups for policy decisions. When parsing JSON content originating from an email header (which is entirely attacker-controlled), the code performs improper handling of the backslash (\) escape character. Specifically, the implementation incorrectly skips characters following a backslash without performing the necessary bounds checking on the parse buffer.

The core flaw is a classic out-of-bounds heap write: when the parser encounters a \ at or near the end of the input buffer, it advances the read pointer past the end of the allocated heap region, then writes a parsed character to an output buffer at an offset that is also out of bounds. This occurs because the malformed JSON is accepted by the parser's state machine as a valid token stream (due to relaxed validation of escape sequences), but the actual memory advancement exceeds the buffer boundaries.

The attack surface is the Exim SMTP daemon, which listens by default on port 25. The vulnerable code path requires:

1. The JSON lookup feature to be compiled into the binary (LOOKUP_JSON=yes at build time) and enabled in the configuration.
2. An ACL, router, or data lookup statement that references ${lookup json{...}} or equivalent JSON operator syntax, processing data derived from message headers.
3. An attacker who can send an email (or multiple emails) to the target MTA with a crafted header containing the malformed JSON payload.

Because the vulnerability is triggered during message processing (after the DATA command in SMTP), no authentication is required. The parsing occurs when Exim evaluates the header content — this can happen during ACL evaluation (e.g., acl_check_data before queueing), during routing decisions, or during transport. The malformed JSON does not need to pass any content validation since the flaw is in the escape-sequence handler, not in overall JSON syntax validation.

The incorrect implementation of \ skipping means that sequences like \\, \", \/ are handled, but the edge case where the backslash is the final byte before the buffer boundary causes an uninitialized or adjacent heap memory region to be read and subsequently written. Under specific heap layouts, this can corrupt adjacent objects, leading to a crash (null pointer dereference, assertion failure) or, with heap grooming, potential code execution.

Exploitation Scenarios

Scenario 1: Remote Denial-of-Service (Mass Email Campaign)

1. Reconnaissance: The attacker scans the internet for SMTP servers (port 25) running Exim. Banner grabbing (EHLO response revealing "Exim 4.9x") or timing-based fingerprinting identifies vulnerable versions (pre-4.99.2). Shodan queries such as product:"Exim" port:25 or Censys searches provide a target list.

2. Weaponization: The attacker crafts a single email message with a crafted header, for example: X-Custom-JSON: {"foo": "\ followed by a long sequence (e.g., 100KB) of \ characters and a single closing quote to trigger the parser edge case. The malformed JSON is embedded in the Subject: or a custom X- header.

3. Execution: The attacker connects via SMTP (telnet target 25 or a Python script), sends HELO, MAIL FROM:, RCPT TO: to a valid local recipient (required for the message to enter the processing pipeline), then issues DATA and transmits the crafted message, ending with .\r\n. Upon message receipt, Exim evaluates the header against the JSON lookup operator in an ACL (e.g., warn condition = ${lookup json{$h_x-custom-json:}}).

4. Post-exploitation: The JSON operator's \ skipping logic reads/writes past heap bounds, causing a segmentation fault or abort in the Exim process. The child process handling the SMTP connection dies; with enough concurrent messages, the Exim queue manager or main daemon may also crash, disrupting email delivery for the entire organization. The attacker can repeat this to sustain a denial-of-service.

Scenario 2: Attempted Code Execution (Targeted)

1. Reconnaissance: Attacker identifies a high-value target (e.g., a financial institution's mail server) through certificate transparency logs or MX record analysis. They confirm Exim version via EHLO response.

2. Trigger: The attacker sends a crafted email where the JSON payload contains specific escape sequences designed to influence the heap layout (\x00, \\, repeated bytes) to corrupt a dangling pointer or function pointer stored in an adjacent heap chunk.

3. Payload/Execution: While no public proof-of-concept exists, the attacker uses heap grooming — sending multiple messages with varying payload sizes to shape the heap — then triggers the OOB write to overwrite a heap metadata structure or a function pointer in the Exim process. The overwritten pointer is later dereferenced during a subsequent SMTP command, redirecting execution to a ROP chain or shellcode placed in the same message.

4. Post-exploitation: Successful code execution grants the attacker the privileges of the Exim user (typically exim or mail, not root due to privilege separation). From there, the attacker pivots to exfiltrate mailbox data, modify routing tables to redirect mail, install a spam relay, or escalate privileges via local kernel vulnerabilities.

Impact Assessment

CVSS 6.5 (Medium) — Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The low confidentiality, integrity, and availability subscores reflect the conditional nature of exploitation — the JSON lookup feature must be enabled and referenced, and the attacker's ability to write memory does not guarantee controlled corruption on the first attempt. However, the unauthenticated, network-based attack vector (AV:N, AC:L) makes this a serious concern for the large population of incorrectly configured Exim servers.

Business Impact:

• Email disruption: Successful DoS stops both inbound and outbound mail, disrupting business communications, automated notifications, and transactional emails.
• Data leakage: If code execution is achieved, mailbox contents (containing sensitive business data, credentials, contractual information) can be exfiltrated.
• Reputation damage: If the compromised server is used as a spam relay, the organization's IP ranges may be blacklisted, causing legitimate email to be rejected by major providers.

Blast Radius: Exim is one of the most widely deployed MTAs on the internet. Estimates place its market share at 50-70% of public mail servers. Any organization running Exim with the JSON lookup feature compiled in and referenced in configuration is exposed. The default Debian build does enable JSON lookups, making the default installation vulnerable.

CISA KEV: Not listed (as of this writing). However, the EPSS percentile of 24.5% indicates a moderate-to-low probability of exploitation in the wild, though this could change rapidly once public exploit code circulates.

Detection Guidance

Sigma Rule

title: Exim CVE-2026-40685 Malformed JSON Header Attempt
id: 8f3a1c2e-9b4d-4f85-a1c3-7e9d0b2f4a51
status: experimental
description: Detects SMTP sessions containing messages with malformed JSON in headers, characteristic of CVE-2026-40685 exploitation attempts.
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40685
tags:
    - attack.t1190
logsource:
    category: smtp
    product: exim
detection:
    selection:
        # Look for DATA command content with excessive backslash sequences
        # This string is a common trigger pattern (many consecutive \ chars)
        data|contains|all:
            - '\'
            - 'JSON'
        # Exim mainlog entries showing crash or parse failure near JSON ops
        exim_error|contains:
            - 'json'
            - 'segmentation fault'
            - 'out of memory'
    condition: selection
    timeframe: 5m
falsepositives:
    - Legitimate emails containing backslashes in JSON-like headers (rare)
    - Intentional stress-testing by security teams
level: high

YARA Rule

rule Exim_CVE_2026_40685_Malformed_JSON {
    meta:
        author = "Valter Security Research"
        description = "Detects SMTP payloads containing malformed JSON with backslash overflow patterns targeting Exim CVE-2026-40685"
        cve = "CVE-2026-40685"
        date = "2026-06-01"
    strings:
        $a = /\\{20,}/                       // 20+ consecutive backslashes
        $b = /"\\+[^\\"]/                     // escape followed by unquoted char
        $c = "json" nocase
        $d = "${lookup json" nocase           // Exim lookup syntax
    condition:
        any of them and
        #a > 3 and
        (filesize < 1MB)
}

Suricata IDS Rule

alert tcp any any -> any 25 (msg:"EXIM CVE-2026-40685 Malformed JSON Header Attempt"; flow:to_server,established; content:"DATA"; nocase; content:"\\"; within:200; content:"{"; within:100; pcre:"/\\\\{10,}/"; pcre:"/{2,}[A-Za-z0-9_-]*:/sm"; classtype:attempted-dos; sid:40706685; rev:1; metadata:created_at 2026-06-01, cve CVE-2026-40685, severity major;)

Elastic Detection

// Detect Exim processes crashing or showing heap-related errors
// following messages with malformed JSON
sequence by host.name with maxspan=5m
  [network where destination.port == 25 and
   process.name == "exim" and
   network.protocol == "smtp"]
  [process where event.action == "disassociate" and
   process.name == "exim" and
   process.exit_code != 0 and
   // Look for common crash messages in logs
   process.command_line == "*json*" or process.args == "*json*"]

Splunk SPL Query

index=exim sourcetype=exim_mainlog
| search "json" ( "segmentation fault" OR "buffer overflow" OR "out of bounds" OR "malloc" OR "abort" )
| eval cve="CVE-2026-40685"
| stats count by host, message_id, pid
| append [
    index=exim sourcetype=exim_rejectlog
    | search "json" OR "lookup failed"
    | eval cve="CVE-2026-40685"
    | stats count by host, message_id, pid
]
| dedup message_id
| sort - count

Wazuh OSSEC Rule

<group name="exim,cve-2026-40685,">
  <rule id="100420" level="12">
    <decoded>exim</decoded>
    <match>json:.*(segmentation fault|buffer overflow|abort|error)</match>
    <description>Exim JSON lookup error - possible CVE-2026-40685 exploitation</description>
    <group>vulnerability,exim,remote_access,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <info type="cve">CVE-2026-40685</info>
    <frequency>5</frequency>
    <timeframe>300</timeframe>
    <options>no_full_log</options>
  </rule>

  <rule id="100421" level="8">
    <decoded>exim</decoded>
    <match>json</match>
    <regex>\\.{3,}</regex>
    <description>Exim JSON parser received excessive backslash sequences</description>
    <group>suspicious,exim,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed)

1. Immediate Mitigations:

   • Disable JSON lookups: If the JSON lookup feature is not actively used in your Exim configuration, recompile Exim without LOOKUP_JSON=yes in the build configuration. This completely removes the vulnerable code path.
   • If JSON lookups are required, restrict the input to JSON operators — ensure that ACL/routing statements using ${lookup json{...}} only reference trusted internal data sources (e.g., flat files, databases) and never directly process raw SMTP headers. Add a pre-condition that strips or validates any header before it reaches the JSON operator.
   • Network-layer filtering: Employ an SMTP proxy or firewall that performs deep packet inspection on the DATA phase to detect and block messages with excessive backslash sequences in headers (patterns matching \\{10,}). Implement this only as a stopgap — false positives are possible with legitimate messages.

2. Patch/Upgrade Steps:

   • Upgrade Exim to version 4.99.2 or later. The fix addresses the incorrect \ skipping implementation in the JSON lookup parser by adding proper bounds checking before advancing the read/write pointers.
   • Distribution-specific:
     • Debian/Ubuntu: apt update && apt upgrade exim4 (the Debian patch is the source of the claimed fix — verify the package version is ≥4.99.2-1).
     • RHEL/CentOS/Fedora: yum update exim or dnf update exim after enabling the appropriate EPEL repository.
     • Source compile: Download Exim 4.99.2 from the official site, verify the PGP signature, and recompile with your existing configuration. Test in staging before production rollout.
   • Verify patch: After upgrading, run exim --version to confirm the version string.

3. Long-Term Hardening:

   • Disable unused features: Review the Exim build configuration (Local/Makefile) and disable all lookup types and features not in active use. This reduces the attack surface for future vulnerabilities.
   • Apply least privilege: Run Exim as a dedicated user with minimal permissions, not root or a user with sudo privileges. Use chroot jail if supported (chroot = /path/to/jail).
   • Monitor advisories: Subscribe to the Exim security announcement mailing list and the CISA Known Exploited Vulnerabilities catalog. Given the CWE-684 (Incorrect Provision of Specified Functionality) classification, similar issues in adjacent lookup types (e.g., SQL, LDAP, Redis) should be proactively audited.
   • Enable logging: Ensure Exim mainlog and rejectlog are rotated and shipped to a SIEM for retrospective analysis.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-40685
2. MITRE CVE Record: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40685
3. Exim Official Repository: https://github.com/Exim/exim (tag exim-4.99.2 containing the security fix)
4. Exim Security Mailing List Archives: https://lists.exim.org/lurker/list/exim-announce.html
5. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-40685

Threat Actor Campaigns / Exploitation in the Wild: As of this report, there are no confirmed in-the-wild exploitation campaigns targeting this CVE, and it is not included in the CISA KEV catalog. The EPSS score (0.00321, 24.5th percentile) suggests low current exploit activity. However, the vulnerability's position in the SMTP attack surface and the prevalence of Exim deployments make it a strong candidate for future botnet-driven mass scanning and exploitation attempts. Security teams should prioritize patching, especially for internet-facing servers.