The vulnerability involves an out‑of‑bounds write in Exim’s SPA authentication driver when processing a malicious SPA resource. The write can crash the connection instance or cause erroneous data processing that leaks uninitialized heap memory. The resulting impact includes service disruption and potential leakage of sensitive data; the flaw is classified as CWE‑909, a memory corruption weakness.

Exim, versions prior to 4.99.2 are affected. No other vendors are listed. An attacker can exploit any Exim deployment running a pre‑4.99.2 build with the SPA authentication driver enabled.

The CVSS score is 4.8, indicating a moderate risk. EPSS information is unavailable, so the likelihood of exploitation is unclear. The vulnerability is not present in the CISA KEV catalog. The attack likely requires an attacker who can send crafted SMTP traffic to the Exim server with an adversarial SPA resource; the flaw appears during normal authentication processing, so a successful exploit could lead to a crash or data leakage but does not provide remote code execution or privilege escalation.