CVE-2026-40687: In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-

CVE-2026-40687 is a vulnerability in Exim email software (before version 4.99.2) where the SPA authentication driver (a method for verifying user identity) can be exploited with a malicious SPA resource to cause an out-of-bounds write (writing data to memory locations outside the intended area), which crashes the email connection or exposes uninitialized heap memory data (unused memory that may contain sensitive information).