A critical flaw in certain Exim mail servers could let an unauthenticated remote attacker run arbitrary code on affected systems, with the issue fixed in Exim 4.99.3. The bug, tracked as CVE-2026-45185, affects some builds before 4.99.3 that use GnuTLS and advertise STARTTLS and CHUNKING.
KEY FACTS
- Impact Remote code execution on vulnerable Exim servers
- Affected builds Versions 4.97 through 4.99.2 compiled with GnuTLS
- Trigger A user-after-free bug during TLS shutdown with BDAT traffic
- Not affected OpenSSL-based builds
An XBOW technical disclosure says the flaw was found by researcher Federico Kirschbaum and reported to Exim maintainers on May 1. The report says maintainers acknowledged it on May 5, and impacted Linux distributions were notified three days later.
The issue affects Exim versions 4.97 through 4.99.2 on builds compiled with the default GnuTLS library when STARTTLS and CHUNKING are advertised. The bug is a user-after-free condition that appears during TLS shutdown while handling BDAT chunked SMTP traffic.
According to the disclosure, Exim frees a TLS transfer buffer and later continues using stale callback references that can write into freed memory. That behavior could allow attackers to run commands on the server and access Exim data and emails, and in some cases move further into the environment.
XBOW also described a seven-day effort to build a proof-of-concept exploit, involving both its autonomous AI-driven system and a human researcher with LLM assistance. The report says the human researcher ultimately succeeded first.
Exim 4.99.3 includes the fix. Users of Ubuntu and Debian-based systems are advised to apply the updated package through their package managers.
WHY IT MATTERS
Exim is widely used on Linux and Unix servers, including shared hosting and enterprise mail systems. Systems that run the affected GnuTLS builds could face full server compromise if the flaw is exploited before updates are installed.