CVE-2026-45185

critical

Description

Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.

References

https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim

https://www.openwall.com/lists/oss-security/2026/05/12/4

http://www.openwall.com/lists/oss-security/2026/05/12/25

https://www.bleepingcomputer.com/news/security/new-critical-exim-mailer-flaw-allows-remote-code-execution/

https://thehackernews.com/2026/05/new-exim-bdat-vulnerability-exposes.html

https://github.com/liamromanis101/k8s-container-escape-audit-lite

https://github.com/materaj2/cve-2026-45185-detection-script

https://github.com/liamromanis101/Dead.Letter-CVE-2026-45185

https://news.ycombinator.com/item?id=48111748

https://exim.org/static/doc/security/EXIM-Security-2026-05-01.1/

https://exim.org/static/doc/security/CVE-2026-45185.txt

https://exim.org

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29824

https://code.exim.org/exim/wiki/wiki/EximSecurity

Details

Source: Mitre, NVD

Published: 2026-05-12

Updated: 2026-05-28

Named Vulnerability: GHSA-fhg4-whcv-f8v4Named Vulnerability: Dead.Letter

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.00944