CVE-2026-45185

CRITICAL

Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.

CVSS v3.1 Score

9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Published: 5/12/2026Modified: 5/13/2026

Related Intelligence (2)

MEDIUMVulnerability

Dead.Letter (CVE-2026-45185) How XBOW found an unauthenticated RCE on Exim

[object Object]

CVE-2026-45185
r/netsec
MEDIUMVulnerability

New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution

Exim has released security updates to address a severe security issue affecting certain configurations that could enable memory corruption and potential code execution. Exim is an open-source Mail Transfer Agent (MTA) designed for Unix-like systems to receive, route, and deliver email. The vulnerability, tracked as CVE-2026-45185, aka Dead.Letter, has been described as a use-after-free

CVE-2026-45185
The Hacker News

References (8)

https://code.exim.org/exim/wiki/wiki/EximSecurityhttps://exim.orghttps://exim.org/static/doc/security/CVE-2026-45185.txthttps://exim.org/static/doc/security/EXIM-Security-2026-05-01.1/https://news.ycombinator.com/item?id=48111748https://www.openwall.com/lists/oss-security/2026/05/12/4https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-eximhttp://www.openwall.com/lists/oss-security/2026/05/12/25