Ubuntu 22.04 LTS Exim Critical Remote Code Exec Issues USN-8228-1

ubuntu

May 4, 2026

Several security issues were fixed in Exim.

Summary

Several security issues were fixed in Exim.

Software Description:

- exim4: Exim is a mail transport agent

Details:

It was discovered that Exim incorrectly handled parsing malformed JSON

in message headers. A remote attacker could possibly use this issue to

execute arbitrary code. (CVE-2026-40685)

It was discovered that Exim incorrectly handled processing of UTF-8

trailing characters. A remote attacker could possibly use this issue to

obtain sensitive information. (CVE-2026-40686)

It was discovered that Exim incorrectly handled SPA authenticator input.

An authenticated user could possibly use this issue to execute arbitrary

code. (CVE-2026-40687)

Topics Covered

security advisory critical code execution exim Ubuntu sensitive data

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  exim4                           4.99.1-1ubuntu1.1
  exim4-base                      4.99.1-1ubuntu1.1
  eximon4                         4.99.1-1ubuntu1.1

Ubuntu 25.10
  exim4                           4.98.2-1ubuntu2.1
  exim4-base                      4.98.2-1ubuntu2.1
  eximon4                         4.98.2-1ubuntu2.1

Ubuntu 24.04 LTS
  exim4                           4.97-4ubuntu4.4
  exim4-base                      4.97-4ubuntu4.4
  eximon4                         4.97-4ubuntu4.4

Ubuntu 22.04 LTS
  exim4                           4.95-4ubuntu2.7
  exim4-base                      4.95-4ubuntu2.7
  eximon4                         4.95-4ubuntu2.7

In general, a standard system update will make all the necessary changes.