CVE-2026-48840Patch(exim / exim)

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch exim exim systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client.

exim CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Other references

https://lists.debian.org/debian-lts-announce/2026/06/msg00004.html

Weakness type (CWE)

CWE-839

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

exim

Threat summary

Patch or workaround signal is available
8 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 5 signals
Technical details provided in 7 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 3d ago at 3 mentions (2026-05-30); latest day: 1
8 total mentions across 5 days

Affected systems

Vendors

exim

Products

exim

Deep dive

Activity timeline8 mentions / 5d

Signal classification3 categories

Patch

450.0%

Disclosure

337.5%

General

112.5%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-29	2	Disclosure1General1
2026-05-30	3	Disclosure2Patch1
2026-06-10	1	Patch1
2026-07-01	1	Patch1
2026-07-08	1	Patch1

Full discourse8 posts

sin99xx@sin99xx137d
Patch
Happy to finally share my latest find: CVE-2026-48840 in Exim. It’s a pre-auth uninitialized stack leak in the PROXY-protocol parser. Confirmed it leaks live userspace VA pointers, making it a perfect ASLR-defeat primitive for exploit chains. Fixed in 4.99.4. Full details: https://www.openwall.com/lists/oss-security/2026/05/29/3
Post summary
The author reports a pre‑authentication stack leak in Exim (CVE-2026-48840), highlights its potential for ASLR bypass, and notes that the vulnerability is fixed in version 4.99.4.
315256235.1K
922 followersView on X
二本松哲也@t_nihonmatsu98d
Patch
Shodanで確認すると、日本国内でも Exim を外部公開しているホストが多数確認できます。メールサーバはインターネット境界に置かれることが多く、脆弱性を放置すると、不正アクセス、情報漏えい、踏み台化、メール配送基盤の悪用につながる可能性があります。 CVE-2026-40685 は Exim 4.99.2 未満、 CVE-2026-48840 は条件付きで 4.88〜4.99.3 が影響対象となるため、古い Exim を公開している環境は早急な確認が必要です。対応としては、まず以下を確認してください。・Exim のバージョン確認・Exim 4.99.4 以上への更新・JSON lookup の利用有無・untrusted header を JSON operator で処理していないか・SUPPORT_PROXY / hosts_proxy の設定有無・不要な外部公開や広すぎるアクセス許可の見直し CVSS の点数だけでなく、自組織の構成で攻撃到達性があるかを確認することが重要です。ただし、MTA は外部公開されやすい重要な境界システムです。該当する可能性がある場合は、至急対応を推奨します。
Post summary
Exim versions below 4.99.4 are vulnerable to CVE‑2026‑40685 and CVE‑2026‑48840, and the post recommends updating to 4.99.4+ and reviewing configuration to mitigate risk.
11002841.6K
17.9K followersView on X
Open Source Security mailing list@oss_security138d
Disclosure
CVE-2026-48840: Exim: PROXY-protocol uninitialised-stack information disclosure https://www.openwall.com/lists/oss-security/2026/05/29/3 The leaked bytes are confirmed to be live userspace VA pointers, making this an ASLR-defeat primitive usable as a chain component. Fixed in 4.99.4.
Post summary
The text announces CVE‑2026‑48840 as an Exim PROXY‑protocol uninitialised‑stack info‑disclosure that leaks VA pointers (usable for ASLR defeat), with a fix released in version 4.99.4.
02070679
4.7K followersView on X
二本松哲也@t_nihonmatsu105d
Patch
ありがとうございます。おっしゃる通り、まずは Exim 4.99.4 以上への更新が最優先ですね。 CVE-2026-40685 は NVD では 9.8 Critical と評価されていますが、実際のリスクは JSON lookup の利用有無や、untrusted header を JSON operator で処理しているかに依存します。そのため深刻だが、構成確認が重要という整理が実務的だと思います。あわせて、CVE-2026-48840 のように PROXY protocol / hosts_proxy の設定に依存する脆弱性もあるため、単にバージョンだけでなく、Exim の有効機能と到達経路を確認することが大切ですね。
Post summary
The post emphasizes upgrading to Exim 4.99.4 to address the high‑severity CVEs, while noting that configuration checks are essential to mitigate risks.
0000186
15.6K followersView on X
CVE@CVEnew137d
Disclosure
CVE-2026-48840 Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client. https://www.cve.org/CVERecord?id=CVE-2026-48840
Post summary
The post references CVE‑2026‑48840 and describes an information‑disclosure issue in Exim caused by mishandling short payloads through proxies, but it does not provide a PoC, exploit, or patch information.
00010315
57.6K followersView on X
ThreatCluster@threatcluster126d
Patch
A pre-auth information disclosure bug tracked as CVE-2026-48840 affects Exim on Fedora 43 and 44, with a fix shipped in Exim 4.99.4 on 1 June 2026, according to Linuxsecurity. https://threatcluster.io/cluster/critical-information-disclosure-vulnerability-in-exim-affect-a2ac26db
Post summary
The post reports a pre‑authentication information disclosure vulnerability (CVE‑2026‑48840) in Exim on Fedora 43/44 and notes that a patch (Exim 4.99.4) was released on 1 June 2026. No PoC or exploitation evidence is provided.
00000108
318 followersView on X
Infoflowcloud@infoflowcloud137d
Disclosure
🚨*CVE* CVE-2026-48840 Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client. https://www.cve.org/CVERecord?id=CVE-2026-48840 ----- Traducción: CVE-2026-48840 Exim 4.88 … http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑48840, a stack‑memory disclosure vulnerability in Exim 4.88 versions when handling certain short payloads in proxy configurations.
0000047
79 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds138d
General
CVE-2026-48840 CVE-2026-48840 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-48840
Post summary
The post merely repeats the CVE identifier and links to a vulnerability‑details page without providing additional context or actionable information.
0000062
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	exim	exim	-	-	-

Explore more

Back to dashboard exim CVEs exim vulnerabilities

What researchers are saying

CVE-2026-48840

sin99xx[verified]@sin99xxPatch

The author reports a pre‑authentication stack leak in Exim (CVE-2026-48840), highlights its potential for ASLR bypass, and notes that the vulnerability is fixed in version 4.99.4.

二本松哲也[verified]@t_nihonmatsuPatch

Exim versions below 4.99.4 are vulnerable to CVE‑2026‑40685 and CVE‑2026‑48840, and the post recommends updating to 4.99.4+ and reviewing configuration to mitigate risk.

二本松哲也[verified]@t_nihonmatsuPatch

The post emphasizes upgrading to Exim 4.99.4 to address the high‑severity CVEs, while noting that configuration checks are essential to mitigate risks.

ThreatCluster[verified]@threatclusterPatch

The post reports a pre‑authentication information disclosure vulnerability (CVE‑2026‑48840) in Exim on Fedora 43/44 and notes that a patch (Exim 4.99.4) was released on 1 June 2026. No PoC or exploitation evidence is provided.

Open Source Security mailing list@oss_securityDisclosure

The text announces CVE‑2026‑48840 as an Exim PROXY‑protocol uninitialised‑stack info‑disclosure that leaks VA pointers (usable for ASLR defeat), with a fix released in version 4.99.4.

CVE@CVEnewDisclosure

The post references CVE‑2026‑48840 and describes an information‑disclosure issue in Exim caused by mishandling short payloads through proxies, but it does not provide a PoC, exploit, or patch information.

Infoflowcloud@infoflowcloudDisclosure

The post announces CVE‑2026‑48840, a stack‑memory disclosure vulnerability in Exim 4.88 versions when handling certain short payloads in proxy configurations.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The post merely repeats the CVE identifier and links to a vulnerability‑details page without providing additional context or actionable information.