In Exim versions older than 4.99.2 on systems that use musl libc, a bug in the dn_expand function that handles octal printing can be triggered by malformed DNS data in PTR records. When such data is received, the program crashes the connection instance, causing a denial of service for that connection. The vulnerability does not enable code execution or data disclosure; it purely results in application instability.

The issue affects the Exim mail transfer agent running on platforms that employ the musl libc implementation rather than the GNU libc. All Exim installations with a release prior to 4.99.2 that are built with musl are vulnerable. Exim 4.99.2 and later contain the fix, so upgrading is the recommended approach.

The CVSS base score of 5.9 indicates moderate severity. Because the exploit relies on crafted DNS PTR responses, an adversary could trigger the crash remotely if the mail server performs reverse lookups on inbound connections or otherwise processes DNS responses containing malicious PTR data. No known public exploits are documented and the vulnerability is not present in the CISA KEV catalog. With no EPSS value available, the likelihood of exploitation remains uncertain, but the ability to cause service interruption makes it a relevant concern for mail servers that rely on musl. There is no vendor provided workaround; the patch is the only effective remedy.