CVE-2026-45185

Published: May 12, 2026Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: MITRE (Secondary)

Description

Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.

Affected (1)

Products: Exim: Exim

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Exim Exim	From 4.97 to 4.99.3

Related CWEs

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (8)

https://code.exim.org/exim/wiki/wiki/EximSecurity

Source: cve@mitre.org

Vendor Advisory

https://exim.org

Source: cve@mitre.org

Product

https://exim.org/static/doc/security/CVE-2026-45185.txt

Source: cve@mitre.org

Broken Link

https://exim.org/static/doc/security/EXIM-Security-2026-05-01.1/

Source: cve@mitre.org

Release Notes

https://news.ycombinator.com/item?id=48111748

Source: cve@mitre.org

Issue Tracking

https://www.openwall.com/lists/oss-security/2026/05/12/4

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim

Source: cve@mitre.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2026/05/12/25

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.