CVE-2026-48840 - Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client

Back Back to CVE browser

MEDIUM

Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client

Published May 30, 2026

5.3

MEDIUM

CVSS 3.1

EPSS 0.44%

Description

Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client.

Affected products

Vendor Exim Product Exim Default
unaffected
Affected
- ≥ 4.88, < 4.99.4

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Exim	Exim	unaffected	Affected ≥ 4.88, < 4.99.4

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-839

References (5)

http://www.openwall.com/lists/oss-security/2026/05/29/3
Mailing ListMitigationThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-33446
Advisory
https://exim.org/static/doc/security/EXIM-Security-2026-05-19.1
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/06/msg00004.html
https://www.openwall.com/lists/oss-security/2026/05/29/3
Mailing ListMitigationThird Party Advisory

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2026/05/29/3		Mailing ListMitigationThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-33446		Advisory
https://exim.org/static/doc/security/EXIM-Security-2026-05-19.1		Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/06/msg00004.html
https://www.openwall.com/lists/oss-security/2026/05/29/3		Mailing ListMitigationThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published May 30, 2026

Updated Jun 5, 2026

Reserved May 25, 2026

Link CVE-2026-48840

CISA Vulnrichment

Updated Jun 1, 2026

NVD

Status Modified

Modified Jul 22, 2026

Link CVE-2026-48840

Red Hat

No data

ENISA EUVD

Assigner mitre

Published May 30, 2026

Updated Jun 5, 2026

Link EUVD-2026-33446

GitHub

No data