CVE-2026-45185
9.8 CRITICALExim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path
Published: 2026-05-12 · Last updated: 2026-05-28
Severity and scoring
- CVSS
- 9.8 CRITICAL
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-416
Affected products
| Vendor | Product |
|---|---|
| exim | exim |
Description
Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-45185
- [Vendor advisory]https://code.exim.org/exim/wiki/wiki/EximSecurity
- [Other]https://exim.org
- [Other]https://exim.org/static/doc/security/CVE-2026-45185.txt
- [Other]https://exim.org/static/doc/security/EXIM-Security-2026-05-01.1/
- [Other]https://news.ycombinator.com/item?id=48111748
- [Other]https://www.openwall.com/lists/oss-security/2026/05/12/4
- [Other]https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim
- [Other]http://www.openwall.com/lists/oss-security/2026/05/12/25
Related CVEs
Same vendor
- CVE-2026-48840 — Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack me... (5.3 MEDIUM)
Same CWE
- CVE-2026-12035 — Use after free in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to potentially exploit heap corrupt...
- CVE-2026-12029 — Use after free in Video in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer pr... (8.3 HIGH)
- CVE-2026-12028 — Use after free in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer proc... (8.3 HIGH)
- CVE-2026-12023 — Use after free in GPU in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process ... (8.3 HIGH)
- CVE-2026-12020 — Use after free in Autofill in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker to potentially exploit heap corrupti... (8.8 HIGH)