CVE-2026-40687

Executive Summary

CVE-2026-40687 is a medium-severity memory-safety vulnerability in the Exim mail transfer agent (MTA) affecting versions prior to 4.99.2. The flaw resides in the SPA (Secure Password Authentication) authentication driver, where an adversarial SPA resource can trigger an out-of-bounds write that crashes the connection instance, or erroneous data processing that leaks uninitialized heap memory contents. Organizations running Exim with SPA authentication enabled—typically enterprise mail gateways and ISP infrastructure—are exposed to denial-of-service conditions and potential information disclosure of sensitive heap data. With a CVSS score of 4.8 and no confirmed exploit-in-the-wild activity (EPSS 0.00373), the threat is currently moderate but warrants prompt patching given Exim's critical role in mail infrastructure.

Technical Analysis

The SPA authentication driver in Exim implements Microsoft's Secure Password Authentication protocol (MS-CHAPv2 style challenge-response) for authenticating SMTP clients. The vulnerability manifests in two distinct failure modes, both rooted in improper memory management during SPA resource parsing:

Out-of-Bounds Write (Crash Vector): When parsing an adversarial SPA resource—specifically the challenge/response negotiation fields—the driver fails to validate the declared message length against the actual buffer capacity. An attacker who controls the SPA data stream can craft a message with a length field that exceeds the allocated heap buffer. The subsequent memcpy or buffer-fill operation writes beyond the heap boundary, corrupting adjacent heap metadata. This typically results in an immediate crash of the connection instance (SIGSEGV or heap corruption abort), leading to a denial-of-service condition for that SMTP session. In more severe cases, the heap corruption can cascade to other concurrent connections served by the same worker process.

Uninitialized Heap Memory Disclosure (Information Leak Vector): In the second failure mode, the SPA driver performs conditional reads on data structures that were never fully initialized. When the adversarial SPA resource omits certain optional fields (e.g., the NT response or LAN Manager response), the driver proceeds to process the response buffer without zero-initializing the full structure. Portions of the SPA response that the server echoes back to the client (via the SPA handshake exchange) then contain stale heap data from previously freed memory blocks. This can leak remnants of other users' authentication tokens, session keys, or other sensitive transient data processed by the same Exim process.

Attack Surface: The vulnerability is reachable via the SMTP AUTH command with the spa authentication mechanism. Exim's auth_spa driver is enabled when configured with auth_spa_server or when used as a client driver (auth_spa_client). The attack vector is network-based, requiring only the ability to establish an SMTP connection to the Exim server—unauthenticated for the crash vector, or partially authenticated for the information disclosure path. No special privileges or local access are required. The attack complexity is low, requiring only crafted SPA protocol parameters.

Root Cause Classification (CWE-909): The vulnerability is classified under CWE-909 — Improper Handling of Highly Competing Resource Access or Uninitialized Resource. Specifically, the driver's failure to validate buffer bounds before write operations and its reliance on partially initialized heap structures represent classic memory-management defects introduced during SPA protocol handling code.

Exploitation Scenarios

The following attack chain assumes a remote attacker targeting an Exim server configured with SPA authentication:

Step 1 — Reconnaissance and Target Identification: The attacker begins by scanning for exposed Exim SMTP services using Shodan or masscan, filtering on port 25 (SMTP) with banner grabbing to fingerprint Exim versions. Exim's SMTP banner (e.g., 220 hostname ESMTP Exim 4.97) reveals the version. The attacker targets hosts running versions prior to 4.99.2 that advertise the SPA authentication mechanism. The attacker can verify SPA availability by issuing EHLO followed by AUTH to enumerate advertised mechanisms. Presence of AUTH SPA in the EHLO response confirms the vulnerable path.

Step 2 — Weaponization — Crash Vector (Denial of Service):

1. The attacker establishes a TCP connection to port 25 and completes the SMTP greeting handshake.
2. The attacker sends EHLO attacker.example.com.
3. After receiving the 250 response listing AUTH SPA, the attacker issues AUTH SPA <base64-encoded-crafted-payload>.
4. The crafted payload decodes to an SPA message with a declared cbMessageLength (or equivalently named size field) that exceeds the actual buffer the server has allocated. For example, the attacker declares a length of 8192 bytes while only sending 64 bytes of actual data.
5. The vulnerable parser copies 8192 bytes into a 64-byte heap buffer, causing an out-of-bounds write. The heap corruption triggers a crash (SIGSEGV or abort), terminating the connection. In a forking model (multiple worker processes), each crafted connection kills one worker; repeated connections exhaust the worker pool, denying service to legitimate mail traffic.

Step 3 — Weaponization — Information Disclosure:

1. The attacker follows the same initial handshake but crafts an SPA message that omits the optional NT-response field while retaining the mandatory LM-response field.
2. The server's SPA parser allocates a response structure but fails to zero-initialize a portion of it due to the missing optional field.
3. When the server sends its SPA challenge back to the client, it includes uninitialized heap bytes in the response. The attacker captures this via a standard SMTP client or netcat wrapper.
4. By repeatedly connecting (each with a slightly different malformed SPA structure), the attacker harvests heap fragments. Over enough iterations, the leaked data may expose other users' session tokens, password hashes, or TLS session keys previously stored in freed heap blocks.

Step 4 — Post-Exploitation Impact: For the crash vector, the attacker achieves persistent denial-of-service against the mail service, potentially disrupting business-critical email flow. For the information disclosure vector, captured heap data can be analyzed offline for sensitive material. If authentication tokens or password hashes are recovered, the attacker may escalate to account compromise and unauthorized mailbox access, leading to data exfiltration of business communications.

Impact Assessment

CVSS Score: 4.8 (Medium) — The vulnerability's severity reflects a balance of factors: network reachability (AV:N) increases risk, but the lack of a confirmed public exploit (EPSS 0.00373, 30th percentile) and the requirement for SPA authentication to be explicitly configured reduce the practical attack surface.

Confidentiality Impact (Partial): The information disclosure vector allows leakage of uninitialized heap memory, potentially exposing other users' sensitive authentication data. However, the disclosure is opportunistic—the attacker cannot choose which specific memory contents are leaked.

Integrity Impact (None): The out-of-bounds write cannot be steered to modify specific memory regions in a controlled manner; it is confined to heap corruption that manifests as crashes.

Availability Impact (Partial): Repeated exploitation of the out-of-bounds write crashes connection instances. In Exim's architecture, where each connection is typically handled by a child process, this permits a resource-exhaustion denial-of-service. The crash is not persistent—the child process terminates and is respawned—but high-frequency attempts can effectively degrade the mail service.

Affected Systems & Blast Radius: Exim is deployed on approximately 60% of internet-facing mail servers, making it a cornerstone of global email infrastructure. However, SPA authentication is not a default configuration; it is typically enabled in environments integrating with Windows-based mail clients (e.g., legacy Outlook configurations) or hybrid Exchange deployments. The blast radius is therefore concentrated in enterprises with such integrations. Internet service providers and managed hosting providers running Exim with SPA for legacy client support are the highest-risk segments.

Exploitation Likelihood: At the time of writing, there is no public exploit code, no Nuclei template, and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog. The vulnerability has been disclosed recently, and the EPSS score suggests low marketplace interest. However, the crash vector is trivially exploitable once publicly documented, and the information disclosure vector, while requiring more iterations, is also deterministic and reproducible.

Detection Guidance

The following detection rules target observable indicators of exploitation. Since the crash vector produces server-side crashes and connection terminations, detection focuses on anomaly-based patterns. The information disclosure vector produces protocol-level anomalies in SPA payload structure that can be captured from network traffic.

Sigma Rule

title: Exim SPA AUTH Anomalous Payload Detection
id: 5f8e3c2a-9b4d-4a6e-8f2c-1e58d7a0c3b6
status: experimental
description: Detects anomalous SPA AUTH payloads in Exim SMTP logs indicating potential exploitation of CVE-2026-40687
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-40687
author: Valtersit Threat Intelligence
date: 2026/02/15
logsource:
    product: linux
    service: exim
detection:
    selection_auth_spa:
        event.code: 'auth'
        message|contains: 'AUTH SPA'
    selection_crash_pattern:
        message|contains|all:
            - 'SPA'
            - 'crash'
            - 'memory'
            - 'SIGSEGV'
    selection_short_payload:
        message|contains: 'SPA'
        # Exim logs malformed AUTH attempts with "AUTH command used when not advertised"
        # or "unrecognized authentication method"
    condition: selection_auth_spa and (selection_crash_pattern or selection_short_payload)
falsepositives:
    - Legitimate SPA clients with malformed protocol implementations
    - Normal authentication retries
level: medium
tags:
    - attack.t1190
    - cve.2026.40687
    - cwe.909

YARA Rule

rule exim_spa_cve_2026_40687_heap_overflow {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects SPA AUTH payloads with declared length exceeding actual data, targeting Exim CVE-2026-40687"
        cve = "CVE-2026-40687"
        date = "2026-02-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-40687"
        severity = "medium"
    strings:
        $spa_cmd = "AUTH SPA" ascii nocase
        $spa_negotiate = { 4E 44 52 52 4D 53 47  } // "NDRRMSG" SPA protocol header variant
        $spa_msgtype = "\x01\x00\x00\x00" ascii // Type 1 NTLM/Style SPA negotiation
        $spa_type3 = "\x03\x00\x00\x00" ascii  // Type 3 SPA authentication (large data)
        $spa_unknown = { FF FF FF FF }            // oversized length markers
    condition:
        uint16(0) == 0x0A0D and // CRLF line start
        ($spa_cmd and $spa_negotiate and $spa_msgtype) or
        ($spa_cmd and $spa_type3 and $spa_unknown) and
        filesize > 100 and filesize < 20000
}

Suricata IDS Rule

alert tcp any any -> $EXIM_SERVERS 25 (msg:"ET EXPLOIT Exim SPA AUTH Out-of-Bounds Write Attempt (CVE-2026-40687)"; flow:established,to_server; content:"AUTH SPA"; nocase; content:"|00 00 00 00 00 00 00 00|"; depth:12; within:20; pcre:"/^[A-Za-z0-9+\/=]{40,}/m"; threshold:type both, track by_src, count 10, seconds 60; classtype:attempted-dos; sid:2026000001; rev:1; metadata:created_at 2026_02_15, updated_at 2026_02_15, cve CVE-2026-40687;)

Elastic Detection

// EQL query for Elastic SIEM
// Detects repeated SPA AUTH failures followed by connection terminations
sequence by host.name, process.name with maxspan=5m
  [ authentication where
      message : "*AUTH SPA*" and
      event.code : "auth" and
      outcome : "failure"
  ] with 8 occurrences
  [ process where
      event.action : "exit" and
      exit_code : 139  // SIGSEGV - segmentation fault
  ]

Splunk SPL Query

index=exim OR index=mail sourcetype="exim_mainlog"
| where match(message, "AUTH SPA")
| eval spa_failures = if(match(message, "authentication failed"), 1, 0)
| eval crash_signal = if(match(message, "SIGSEGV|crashed|core dumped"), 1, 0)
| stats count as auth_attempts, sum(spa_failures) as spa_fail_count,
         sum(crash_signal) as crash_count by src_ip, host
| where auth_attempts > 5 OR crash_count > 0
| sort - auth_attempts
| eval signature = "CVE-2026-40687 SPA Exim suspicious activity"
| table _time, src_ip, host, auth_attempts, spa_fail_count, crash_count, signature

Wazuh OSSEC Rule

<group name="exim,">
  <rule id="100406" level="10" frequency="8" timeframe="120">
    <if_sid>43100</if_sid>
    <regex>.*AUTH SPA.*authentication failed.*</regex>
    <description>Exim SPA authentication failure burst - potential CVE-2026-40687 exploitation</description>
    <group>authentication_failures,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100407" level="12" frequency="2" timeframe="60">
    <if_sid>43101</if_sid>
    <regex>.*(SIGSEGV|crashed|core dumped).*</regex>
    <description>Exim process crash immediately after SPA AUTH - CVE-2026-40687 out-of-bounds write</description>
    <group>dos,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED (single source — Debian — claims a patch; not independently confirmed at time of writing).

1) Immediate Mitigations (before patching):

• Disable SPA authentication if not absolutely required. In Exim configuration, comment out or remove the auth_spa_server and auth_spa_client authenticator definitions, or set the server_advertise_condition to disallow SPA advertisement.
• Restrict AUTH capability to trusted networks: Ensure SPA authentication is only advertised on internal interfaces or to authenticated IP ranges.
• Apply rate limiting on AUTH failures using Exim's ratelimit ACL condition to slow automated exploitation attempts.
• Enable core dumps selectively for post-mortem analysis, ensuring crash logs are captured for forensic review.

2) Patch/Upgrade Steps:

• Upgrade to Exim 4.99.2 or later. The fix addresses both the out-of-bounds write and the uninitialized memory disclosure in the SPA driver.
• For Debian-based systems: apt update && apt upgrade exim4 (or exim4-daemon-heavy if applicable). Verify the installed version: exim -bV.
• For source builds: Download the patched tarball from the official Exim repository (https://github.com/Exim/exim), verify GPG signatures, and rebuild using your existing build configuration.
• Confirm patch installation by testing the SPA AUTH mechanism against a staging server with malformed payloads to verify crash is no longer reproducible.

3) Long-Term Hardening:

• Transition away from SPA authentication: SPA (NTLM-style) authentication is legacy and insecure. Migrate to CRAM-MD5, SCRAM-SHA-256, or GSSAPI/Kerberos, which provide stronger security guarantees.
• Implement network segmentation: Place mail servers behind a dedicated SMTP gateway that filters and rate-limits AUTH commands before they reach Exim.
• Deploy a web application firewall (WAF) or SMTP proxy that inspects AUTH payloads for oversized length fields.
• Maintain a regular patch cadence: Subscribe to Exim announcement lists and monitor NVD/CISA for new CVEs affecting the platform.
• Monitor heap-related crashes in Exim logs as an early-warning indicator for future memory-safety vulnerabilities.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-40687
2. Exim Official Repository & Advisory: https://github.com/Exim/exim/releases (track releases for version 4.99.2)
3. Debian Security Tracker (Patch Source): https://security-tracker.debian.org/tracker/CVE-2026-40687
4. MITRE CVE Record: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40687
5. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-40687 is not listed (no confirmed in-the-wild exploitation at time of writing).

Threat Actor Campaigns: No known threat actor campaigns or exploit-in-the-wild activity have been attributed to CVE-2026-40687 as of the writing of this report. The EPSS score (0.00373) places this in the low exploitation likelihood percentile. However, Exim remains a high-value target for nation-state actors and financially motivated groups given its market prevalence; monitoring for subsequent PoC publication and weaponization is strongly advised.