What is the CVSS score of CVE-2026-45185?

CVE-2026-45185 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Exim are affected by CVE-2026-45185?

Exim mail transfer agents before version 4.99.3 contain a critical remote code execution vulnerability exploitable without authentication, with public exploit code available.. A patch is available.

Is there a public PoC exploit available for CVE-2026-45185?

Yes, a public proof-of-concept exploit is available for CVE-2026-45185. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-45185?

Within 24 hours, conduct an asset inventory to identify all systems running Exim before version 4.99.3, with particular focus on production mail transfer agents. Within 7 days, deploy Exim version 4.99.3 or later across all affected systems, prioritizing production infrastructure and validating patches in non-production environments first. Within 30 days, complete full patching across all Exim installations, verify mail flow continuity through end-to-end testing, and update patch management records.

Exim CVE-2026-45185

EUVD-2026-29824 CRITICAL

Use After Free (CWE-416)

2026-05-12 mitre

GHSA-fhg4-whcv-f8v4

Memory Corruption RCE Use After Free N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable and unauthenticated (AV:N/PR:N), but the non-default GnuTLS config plus precise close_notify timing and heap-grooming for RCE justify AC:H; UAF can yield full compromise (C/I/A:H).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 22:32 vuln.today

CVSS changed

May 12, 2026 - 21:22 NVD

9.8 (CRITICAL)

CVE Published

May 12, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

CVE Published

May 12, 2026 - 00:00 nvd

CRITICAL 9.8

DescriptionCVE.org

Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.

Articles & Coverage 1

POC CVE-2026-45185: Exim STARTTLS CHUNKING Detection POC Scripts May 14, 2026

AnalysisAI

Remote code execution in the Exim mail transfer agent (versions before 4.99.3) built against certain GnuTLS configurations arises from a use-after-free in the BDAT/CHUNKING body-parsing path. An unauthenticated network attacker who sends a TLS close_notify mid-body during a CHUNKING transfer followed by a trailing cleartext byte on the same TCP connection can corrupt the heap and, per the advisory, execute arbitrary code. Publicly available exploit code exists, but there is no CISA KEV listing and EPSS is very low (0.06%, 18th percentile), so this is best treated as a high-impact issue with no confirmed active exploitation yet.

Technical ContextAI

Exim is a widely used open-source SMTP mail transfer agent. The flaw is a CWE-416 use-after-free in the code that parses message bodies delivered via the SMTP CHUNKING extension (RFC 3030 BDAT commands), which sends data in length-prefixed chunks rather than dot-terminated DATA. The bug is specific to builds/configurations that use GnuTLS as the TLS backend: when a client issues a TLS close_notify alert in the middle of a BDAT body transfer and then writes a final cleartext byte on the same TCP socket, Exim continues to reference a buffer or connection object that has already been freed as part of TLS teardown, resulting in heap corruption that can be steered toward code execution.

RemediationAI

Upgrade to Exim 4.99.3 or later, which contains the fix; this is the primary and recommended action (Vendor-released patch: 4.99.3). Distribution users should apply their vendor's backported package - for example the Ubuntu update tracked in USN-8382-1 (https://ubuntu.com/security/notices/USN-8382-1). As a targeted compensating control until patching, because the flaw is specific to GnuTLS handling of the CHUNKING path you can either switch the TLS backend to OpenSSL if your build supports it, or disable the SMTP CHUNKING/BDAT capability (for example by not advertising the CHUNKING extension in your ACL/configuration) so the vulnerable BDAT body-parsing path is not reachable; the trade-off is that clients relying on CHUNKING will fall back to standard DATA transfer, which is generally acceptable but may slightly reduce throughput for large-message senders. Restricting SMTP exposure to trusted networks or fronting Exim with a filtering relay reduces exposure but does not eliminate the bug. Consult the Exim advisory (https://exim.org/static/doc/security/CVE-2026-45185.txt) and the Exim security wiki (https://code.exim.org/exim/wiki/wiki/EximSecurity) before changing TLS backends.