CVE-2026-45185 Use after free in Exim
An unauthenticated attacker can execute arbitrary code on Exim mail servers using GnuTLS by triggering a use-after-free during TLS chunking transfers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45185?
CVE-2026-45185 is a critical use after free vulnerability in Exim Exim, published on 12 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.
Weakness: CWE-416
Which versions are affected by CVE-2026-45185?
It affects 1 product.
Products include Exim Exim.
How do I fix CVE-2026-45185?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-45185 being exploited?
There is no known exploitation of CVE-2026-45185 in the wild and no public exploit code.
Public exploit code: 4 proofs of concept on GitHub.
Other vulnerabilities in Exim Exim
Sources
Also known as CLSA-2026-1781269872, DEBIAN-CVE-2026-45185, GHSA-fhg4-whcv-f8v4, UBUNTU-CVE-2026-45185, USN-8270-1.