CVE-2026-40684 — In Exim before 4.99.2, on systems using musl libc (not

title: CVE-2026-40684 - Exim PTR Record DNS Expansion Crash Attempt
id: scw-2026-04-30-ai-1
status: experimental
level: high
description: |
  This rule detects attempts to exploit CVE-2026-40684 by looking for DNS queries for PTR records (indicated by '.in-addr.arpa' in the domain) that contain specific octal escape sequences. These sequences, when processed by Exim on musl libc systems, can lead to a crash of the connection instance due to a dn_expand oddity. This is a direct indicator of an attempted exploit for this vulnerability.
author: SCW Feed Engine (AI-generated)
date: 2026-04-30
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-40684/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: dns
detection:
  selection:
      dst_domain|contains:
          - '.in-addr.arpa'
      query|contains:
          - '\\000'
      query|contains:
          - '\\1'
      query|contains:
          - '\\2'
      query|contains:
          - '\\3'
      query|contains:
          - '\\4'
      query|contains:
          - '\\5'
      query|contains:
          - '\\6'
      query|contains:
          - '\\7'
      query|contains:
          - '\\8'
      query|contains:
          - '\\9'
      condition: dst_domain AND query
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse