critical CVSS 9.8 EPSS 0.94%

CVE-2026-45185·Exim vulnerability

Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.

Severity
critical
Software
Exim
Fixed in
4.99.3
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.94% — higher than 60% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-45185 scores 9.8 on CVSS, so a successful attack would be serious — but at 0.94%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

From: 4.97

Until: 4.99.3

Fixed in: 4.99.3

How to fix this CVE

Upgrade Exim to version 4.99.3 or later to patch a critical use-after-free vulnerability in the BDAT body parsing logic that occurs during TLS renegotiation in GnuTLS configurations. Organizations running Exim 4.97 through 4.99.2 should prioritize this update immediately, as the vulnerability allows unauthenticated remote code execution without authentication or user interaction.

sudo dnf update exim

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

TLS_CLOSE_NOTIFY_MID_BDAT|excessive_heap_corruption_signals|BDAT.*cleartext_continuation|TLS.*renegotiation_error.*followed_by_raw_data

How to check if you are affected

  1. Check installed Exim version: exim -bV | head -n 1
  2. Verify GnuTLS support in Exim: exim -bV | grep -i gnutls (confirms if the TLS library in use is vulnerable)
  3. Review mail server logs for TLS close_notify events followed by unexpected cleartext data: grep -i 'close_notify\|tls.*error' /var/log/exim4/mainlog
  4. Confirm patch application: exim -bV | grep -E '4\.99\.[3-9]|4\.[0-9]{2,}\.'

FAQ

What is CVE-2026-45185?

CVE-2026-45185 is a use-after-free memory corruption vulnerability in Exim's BDAT CHUNKING transfer handler that is triggered when a client sends a TLS close_notify message mid-transfer, then continues sending cleartext data on the same TCP connection. This memory corruption can allow remote code execution in GnuTLS-enabled Exim instances.

Is CVE-2026-45185 being actively exploited?

No, CVE-2026-45185 is not currently listed in the CISA Known Exploited Vulnerabilities catalog and no public exploit code is available. However, due to its critical severity and the low barrier to exploitation (no authentication required), organizations should treat it as high-priority regardless of current threat intelligence.

What versions of Exim are affected by CVE-2026-45185?

Exim versions 4.97 through 4.99.2 are vulnerable. The vulnerability has been patched in Exim 4.99.3 and later releases.

How do I check if my server is vulnerable to CVE-2026-45185?

Run 'exim -bV' and check the version number. If it shows 4.97 through 4.99.2, you are vulnerable. Additionally, confirm GnuTLS is in use by running 'exim -bV | grep -i gnutls' — OpenSSL-only builds are not affected.

Does Defensia detect CVE-2026-45185?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Exim is installed on a monitored server, CVE-2026-45185 will appear in your dashboard with remediation steps.

Related Exim CVEs

CVE-2010-4344CVSS 10Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.
CVE-2019-16928CVSS 10Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
CVE-2019-10149CVSS 10A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
CVE-2018-6789CVSS 10An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.
CVE-2017-16944CVSS 9The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-45185. Free for 1 server.

Get started free