An Exim server running before version 4.99.2 can experience an out-of-bounds heap write when the JSON lookup feature is enabled and the server parses malformed JSON embedded in an untrusted header. The corruption arises from an incorrect handling of backslash escapes, leading to CWE‑684. The memory corruption could corrupt internal state, potentially causing a denial of service or other unstable behavior, but the description does not confirm remote code execution capabilities.

Exim, versions earlier than 4.99.2, where the JSON lookup functionality is in use. The vulnerability applies to all installations that expose the JSON lookup feature to external or untrusted email headers.

The CVSS score of 6.5 indicates moderate severity. No EPSS information is available, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is likely network-based, requiring the attacker to send a crafted mail message containing malformed JSON in a header to a vulnerable Exim host. With JSON lookup enabled, an unauthenticated attacker could trigger the out-of-bounds write, causing memory corruption and potentially service disruption.