ANT-2026-B615AQ9E · exim/exim

off-by-one medium

CVE-2026-40685

Severity Claude high · Security research firm high · Maintainer medium

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Calif.

ANT-2026-B615AQ9E: Exim dewrap() Off-By-One OOB Read → Code Execution

The dewrap() function in expand.c (lines 2399-2423) mishandles input where a backslash is immediately followed by the null terminator. The pointer p is incremented twice — once for the backslash and once for the assumed escaped character — advancing it past the end of the string into adjacent heap memory. An attacker who controls the input string can place a trailing backslash to trigger the overread. A demonstrated three-stage exploit (heap spray → malformed JSON → extract json trigger) leaks adjacent heap contents.

Target

Project: exim
Location: expand.c:2399
Discovery: static analysis — not yet dynamically reproduced

Technical Details

The escape-handling path unconditionally performs p++ for the backslash and p++ again for the escaped character without first checking whether the character after the backslash is '\0'. When the backslash is the final byte of the buffer, the second increment moves p one byte past the null terminator, and subsequent processing reads out-of-bounds heap memory.

Reproduction

Spray the heap so attacker-chosen or sensitive data lies adjacent to the input buffer
Submit malformed JSON whose string content ends with a lone backslash before the null terminator
Invoke the extract json trigger, causing dewrap() to read past the null and return out-of-bounds bytes

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-B615AQ9E.

Reference: ANT-2026-B615AQ9E
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Calif.

Verdict: true positive
Severity: high

TIMELINE

Dates from discovery through public reveal.

2026-03-29 Reported to tracker
2026-04-23 Patch released
2026-05-08 Sent to maintainer
2026-05-09 Maintainer acknowledged
2026-08-17 Publicly revealed

PROVENANCE

SHA-3-512 hash:

63eb8de51e73fbb8f1fc13cc19411badec1ea1d06bc18de4b32e6b64d018c1cb0057c933b8b5f2cc66541e6632a67f6898dbd2a27c45c4da35e8337751cd4e31

Committed 2026-05-08 00:09 PT

Revealed 2026-08-17 14:12 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-B615AQ9E",
  "bug_class": "off-by-one",
  "claude_severity": "high",
  "commit_sha": null,
  "created_at": "2026-03-30T01:10:19+00:00",
  "description": "The dewrap() function in expand.c (lines 2399-2423) mishandles input where a backslash is immediately followed by the null terminator. The pointer p is incremented twice — once for the backslash and once for the assumed escaped character — advancing it past the end of the string into adjacent heap memory. An attacker who controls the input string can place a trailing backslash to trigger the overread. A demonstrated three-stage exploit (heap spray → malformed JSON → extract json trigger) leaks adjacent heap contents.",
  "discovered_at": null,
  "location": "expand.c:2399",
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "exim",
  "reproduction": [
    "1. Spray the heap so attacker-chosen or sensitive data lies adjacent to the input buffer",
    "2. Submit malformed JSON whose string content ends with a lone backslash before the null terminator",
    "3. Invoke the extract json trigger, causing dewrap() to read past the null and return out-of-bounds bytes"
  ],
  "technical_details": "The escape-handling path unconditionally performs p++ for the backslash and p++ again for the escaped character without first checking whether the character after the backslash is '\\0'. When the backslash is the final byte of the buffer, the second increment moves p one byte past the null terminator, and subsequent processing reads out-of-bounds heap memory.",
  "title": "Exim dewrap() Off-By-One OOB Read → Code Execution",
  "vendor_severity": "high"
}