Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:HSummary
CVE-2026-40685 is a medium-severity Incorrect Provision of Specified Functionality (CWE-684) vulnerability in Exim Exim. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 25th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-40685 is a vulnerability in the Exim mail transfer agent affecting versions before 4.99.2. When JSON lookup is enabled, an out-of-bounds heap write can occur if a JSON operator processes malformed JSON in an untrusted header, stemming from an incorrect implementation of backslash skipping. The issue is associated with CWE-684 (Incorrect Provisioning of Trust in Caller) and CWE-787 (Out-of-bounds Write) and carries a CVSS v3.1 base score of 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H).
A remote network-accessible attacker without privileges or user interaction can exploit this vulnerability, though it requires high attack complexity. Exploitation triggers the heap write, potentially resulting in high availability disruption and low integrity impact, such as service denial or limited data tampering, with no confidentiality loss.
Exim advisories recommend upgrading to version 4.99.2, which addresses the flaw via commit 9fdc057e71b87c87a0d3d2288b2810a0efaaba57. Detailed security notes and assessments are provided at https://exim.org/static/doc/security/CVE-2026-40685.txt and https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40685.assessment, with the vulnerability announced on the oss-security mailing list at https://www.openwall.com/lists/oss-security/2026/04/30/21.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26443
Vulnerability Data
In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an incorrect implementation of \ skipping.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
—
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation activities are performed precisely to discover when delivered functionality fails to match published specifications.
Requiring a documented development process and supporting tools reduces the chance that specified functionality will be implemented incorrectly.
Input validation can structurally reject or sanitize data that would otherwise trigger an out-of-bounds write.
Memory-protection mechanisms limit the exploitability and blast radius of a successful out-of-bounds write.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce spec-compliant functionality and testing, while eliminating this weakness fulfills only part of the control's broader monitoring intent.
Vulnerability scanning and recording can discover out-of-bounds write flaws so they can be remediated.
Patching or replacing vulnerable software directly eliminates known instances of this coding weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance validates that implemented functionality conforms to specifications before release.
Secure development life cycle includes requirements and verification activities that directly reduce the risk of delivering functionality that deviates from published specifications.
Explicit application security requirements and acceptance criteria help ensure the delivered software matches its intended specifications.
Secure architecture and engineering principles reduce the likelihood of buffer overflows.
Secure coding directly addresses out-of-bounds writes through language choice and coding standards.
Change management processes reduce the chance of unintended functional deviations during updates, though they do not directly address initial specification conformance.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
RHEL 9 (1 rule)
- V-258078 RHEL 9 must use a Linux Security Module configured to enforce limits on system services. prevents CWE-684