CVE-2026-45185
CVSS 9.8 CRITICAL: exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. EPSS 1% (65th percentile), up from 0.1%.
Vulnerabilities · 124 days ago
Exim’s BDAT path is not safely isolated from TLS teardown in GnuTLS builds. A client can force a close_notify before the transfer ends, then send one final cleartext byte on the same connection, and Exim can write into freed memory. That turns a mail-delivery edge case into heap corruption and possible code execution.
The flaw is CVE-2026-45185, and it affects Exim 4.97 through 4.99.2 only on builds using USE_GNUTLS=yes. Exim says the issue is reachable with the CHUNKING (BDAT) SMTP extension and does not affect builds using other TLS libraries such as OpenSSL.
The risk is concentrated but serious for mail gateways that accept BDAT traffic. Patching matters because this is not generic SMTP abuse; it is a protocol-state mismatch during TLS shutdown that can crash the process or, in the worst case, hand control of the server to an attacker.
CVSS 9.8 CRITICAL: exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. EPSS 1% (65th percentile), up from 0.1%.
2 sources covering this story
New critical Exim mailer flaw allows remote code execution
A critical vulnerability affecting certain configurations of the Exim open-source mail transfer agent could be exploited by an unauthenticated remote attacker to execute arbitrary code.
New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution
Exim BDAT flaw affects 4.97–4.99.2 GnuTLS builds, causing heap corruption and possible code execution.
Part of the PlainSec briefing for 2026-05-14