Executive brief
Exim is a widely used mail server responsible for routing and delivering email across the internet. A critical security flaw has been identified that allows an unauthenticated attacker to take complete control of the server remotely. This could lead to the theft of sensitive emails, disruption of communication services, or a total compromise of the underlying system.
Technical details
A use-after-free (UAF) vulnerability exists in Exim's BDAT body parsing path when configured with GnuTLS. The flaw is triggered during a CHUNKING transfer if a client sends a TLS 'close_notify' mid-body, followed by a final cleartext byte on the same TCP connection. This sequence causes a mismatch in object lifecycles between Exim and the GnuTLS library, leading to heap corruption. An unauthenticated remote attacker can exploit this to achieve arbitrary code execution with the privileges of the Exim process. The issue is fixed in Exim version 4.99.3.
Affected products
- Exim Exim 4.97 up to (excluding) 4.99.3
Timeline
- 2025-05-01: disclosed: Vulnerability submitted to Exim security team
- 2026-05-12: advisory: Public release and coordinated disclosure
- 2026-05-12: patched: Fixed in Exim version 4.99.3
References
- https://code.exim.org/exim/wiki/wiki/EximSecurity
- https://exim.org/
- https://exim.org/static/doc/security/CVE-2026-45185.txt
- https://exim.org/static/doc/security/EXIM-Security-2026-05-01.1/
- https://news.ycombinator.com/item?id=48111748
- https://www.openwall.com/lists/oss-security/2026/05/12/4
- https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim