In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade exim | May 4, 2026 | Apr 30, 2026 |
| Debian | — | Upgrade exim4 | May 13, 2026 | May 13, 2026 |
| Exim | — | Upgrade Exim to version 4.99.2 | Jun 9, 2026 | Apr 30, 2026 |
| Gentoo Linux | — | Upgrade mail-mta/exim. | Aug 16, 2026 | Aug 14, 2026 |
| Ubuntu | — | Upgrade exim4-daemon-light (Ubuntu Pro)Upgrade exim4Upgrade exim4 (Ubuntu Pro)Upgrade exim4-base (Ubuntu Pro)Upgrade eximon4Upgrade exim4-dev (Ubuntu Pro)Upgrade exim4-daemon-heavy (Ubuntu Pro)Upgrade eximon4 (Ubuntu Pro)Upgrade exim4-base | May 4, 2026 | Apr 29, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub