Exim BDAT Edge Case Opens Potential Code Execution
Exim’s BDAT path is not safely isolated from TLS teardown in GnuTLS builds. A client can force a close_notify before the transfer ends, then send one final cleartext byte on the same connection, and Exim can write into freed memory. That turns a mail-delivery edge case into heap corruption and possible code execution.
The flaw is CVE-2026-45185, and it affects Exim 4.97 through 4.99.2 only on builds using USE_GNUTLS=yes. Exim says the issue is reachable with the CHUNKING (BDAT) SMTP extension and does not affect builds using other TLS libraries such as OpenSSL.
The risk is concentrated but serious for mail gateways that accept BDAT traffic. Patching matters because this is not generic SMTP abuse; it is a protocol-state mismatch during TLS shutdown that can crash the process or, in the worst case, hand control of the server to an attacker.