EUVD-2026-29824
GHSA-fhg4-whcv-f8v4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect to Exim SMTP service
-
DeliveryStart STARTTLS/GnuTLS session
-
ExploitBegin BDAT CHUNKING body transfer
-
ExecutionSend TLS close_notify mid-body then cleartext byte
-
PersistTrigger use-after-free heap corruption
-
ImpactExecute arbitrary code as Exim process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that Exim (before 4.99.3) be built/configured to use the GnuTLS TLS backend ('certain GnuTLS configurations'), and that the server accept SMTP CHUNKING/BDAT transfers. The concrete trigger is a protocol-timing sequence: a client sends a TLS close_notify alert mid-body during an in-progress BDAT/CHUNKING transfer, then writes a final cleartext byte on the same TCP connection. No authentication is required (PR:N) and no user interaction is needed. Limiting factors that reduce real-world exposure: instances built with OpenSSL instead of GnuTLS, or with CHUNKING not advertised/disabled, are not exploitable via this path; the precise close_notify-then-cleartext timing must be achieved; and reliable code execution (versus a crash) depends on heap grooming, which is harder than the CVSS AC:L rating suggests. |
| Impact | The signals are mixed and should be weighed carefully. CVSS 3.1 rates this 9.8 critical (AV:N/AC:L/PR:N/UI:N, C/I/A all High) and SSVC marks Technical Impact as total and Automatable as yes, which argues for high priority. However, SSVC Exploitation is 'none', there is no CISA KEV entry, and EPSS is only 0.06% (18th percentile), indicating low modeled probability of widespread exploitation. Publicly available exploit code exists (GitHub detection/PoC and an ACN advisory referencing a public PoC), which raises practical concern but is distinct from active exploitation. A key nuance: the CVSS vector encodes AC:L, yet the description requires 'certain GnuTLS configurations' plus a precise close_notify-then-cleartext timing sequence - real-world attack complexity is arguably higher than AC:L implies, and Exim instances built against OpenSSL or without the relevant GnuTLS setting may not be vulnerable. Net: patch promptly given the RCE potential and public PoC, but the current data does not support treating this as mass-exploited in the wild. |
| Exploit ScenarioDerived | An attacker connects to an internet-facing Exim SMTP server that uses the vulnerable GnuTLS configuration, begins a STARTTLS session and a message transfer using BDAT/CHUNKING, then sends a TLS close_notify in the middle of the body followed by one final cleartext byte on the same TCP connection. This triggers the use-after-free and heap corruption, which a crafted sequence can leverage toward arbitrary code execution as the Exim process; public PoC/detection code for this CVE already exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Remote code execution in the Exim mail transfer agent (versions before 4.99.3) built against certain GnuTLS configurations arises from a use-after-free in the BDAT/CHUNKING body-parsing path. An unauthenticated network attacker who sends a TLS close_notify mid-body during a CHUNKING transfer followed by a trailing cleartext byte on the same TCP connection can corrupt the heap and, per the advisory, execute arbitrary code. Publicly available exploit code exists, but there is no CISA KEV listing and EPSS is very low (0.06%, 18th percentile), so this is best treated as a high-impact issue with no confirmed active exploitation yet.
RemediationAI
Upgrade to Exim 4.99.3 or later, which contains the fix; this is the primary and recommended action (Vendor-released patch: 4.99.3). Distribution users should apply their vendor's backported package - for example the Ubuntu update tracked in USN-8382-1 (https://ubuntu.com/security/notices/USN-8382-1). As a targeted compensating control until patching, because the flaw is specific to GnuTLS handling of the CHUNKING path you can either switch the TLS backend to OpenSSL if your build supports it, or disable the SMTP CHUNKING/BDAT capability (for example by not advertising the CHUNKING extension in your ACL/configuration) so the vulnerable BDAT body-parsing path is not reachable; the trade-off is that clients relying on CHUNKING will fall back to standard DATA transfer, which is generally acceptable but may slightly reduce throughput for large-message senders. Restricting SMTP exposure to trusted networks or fronting Exim with a filtering relay reduces exposure but does not eliminate the bug. Consult the Exim advisory (https://exim.org/static/doc/security/CVE-2026-45185.txt) and the Exim security wiki (https://code.exim.org/exim/wiki/wiki/EximSecurity) before changing TLS backends.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Exim is a widely used open-source SMTP mail transfer agent. The flaw is a CWE-416 use-after-free in the code that parses message bodies delivered via the SMTP CHUNKING extension (RFC 3030 BDAT commands), which sends data in length-prefixed chunks rather than dot-terminated DATA. The bug is specific to builds/configurations that use GnuTLS as the TLS backend: when a client issues a TLS close_notify alert in the middle of a BDAT body transfer and then writes a final cleartext byte on the same TCP socket, Exim continues to reference a buffer or connection object that has already been freed as part of TLS teardown, resulting in heap corruption that can be steered toward code execution.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated (AV:N/PR:N), but the non-default GnuTLS config plus precise close_notify timing and heap-grooming for RCE justify AC:H; UAF can yield full compromise (C/I/A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.
Articles & Coverage 1
Executive ViewAI
Exim mail transfer agents before version 4.99.3 contain a critical remote code execution vulnerability exploitable without authentication, with public exploit code available. Unpatched mail servers could allow attackers to compromise email infrastructure, disrupting business-critical communications and enabling data breach or persistent network access. Immediate patching to version 4.99.3 is necessary despite currently low exploitation metrics.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB