CVE-2026-45185

CRITICAL

Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.

CVSS v3.1 Score

9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Published: 5/12/2026Modified: 6/17/2026

Related Intelligence (3)

CRITICALAi

Human oversight is still critical as AI patching tools miss security risks

AI-generated vulnerability patches still heavily depend on human review, particularly the ones involving security-sensitive code, according to a research. Researchers from 1Password have disclosed an internal evaluation that found AI-generated fixes frequently overlook broader concerns such as architectural intent, business requirements, security implications, and long-term maintainability, despit

CVE-2026-31431CVE-2026-34197
CSO Online
MEDIUMVulnerability

Dead.Letter (CVE-2026-45185) How XBOW found an unauthenticated RCE on Exim

[object Object]

CVE-2026-45185
r/netsec
MEDIUMVulnerability

New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution

Exim has released security updates to address a severe security issue affecting certain configurations that could enable memory corruption and potential code execution. Exim is an open-source Mail Transfer Agent (MTA) designed for Unix-like systems to receive, route, and deliver email. The vulnerability, tracked as CVE-2026-45185, aka Dead.Letter, has been described as a use-after-free

CVE-2026-45185
The Hacker News

References (8)

https://code.exim.org/exim/wiki/wiki/EximSecurityVendor Advisoryhttps://exim.orgProducthttps://exim.org/static/doc/security/CVE-2026-45185.txtBroken Linkhttps://exim.org/static/doc/security/EXIM-Security-2026-05-01.1/Release Noteshttps://news.ycombinator.com/item?id=48111748Issue Trackinghttps://www.openwall.com/lists/oss-security/2026/05/12/4Mailing ListThird Party Advisoryhttps://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-eximThird Party Advisoryhttp://www.openwall.com/lists/oss-security/2026/05/12/25Mailing ListThird Party Advisory