CVE-2026-40685 — In Exim before 4.99.2, when JSON lookup is enabled, an

title: Exim Out-of-Bounds Heap Write via Malformed JSON Header - CVE-2026-40685
id: scw-2026-04-30-ai-1
status: experimental
level: critical
description: |
  Detects the specific condition for CVE-2026-40685 in Exim, where an out-of-bounds heap write can occur due to malformed JSON in an untrusted header when JSON lookup is enabled. This is triggered by an incorrect implementation of '\' skipping, leading to potential remote code execution.
author: SCW Feed Engine (AI-generated)
date: 2026-04-30
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-40685/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: email
detection:
  selection:
      Image|contains:
          - 'exim'
      cs-uri-query|contains:
          - '\\'
      condition: Image AND cs-uri-query
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse