Listen to this Post
CVE-2026-45185 represents a critical vulnerability discovered within the Exim mail transfer agent.
It specifically targets the BDAT (binary data) message body parsing implementation.
The flaw is classified under CWE-416 as a classic use-after-free memory corruption issue.
It arises during the complex interaction between SMTP CHUNKING and GnuTLS encrypted connections.
When an unauthenticated client initiates a connection, Exim allocates a plaintext transfer buffer.
Following a successful STARTTLS handshake, function pointers are swapped for TLS-aware wrappers.
Under normal operations, this buffer handles incoming message data streams smoothly.
However, a vulnerability is triggered when a TLS close_notify occurs mid-body.
Specifically, sending this signal during an active CHUNKING transfer disrupts the parsing loop.
The TLS shutdown routine prematurely frees the underlying 4096-byte transfer buffer.
Despite being freed, the BDAT body parser continues to reference the memory address.
Because the parser does not return to its caller immediately, a mid-loop condition occurs.
This leaves a dangling pointer active while data handling operations persist.
An attacker can exploit this state by injecting crafted byte sequences into the stream.
A single newline or specific character written into the freed space corrupts allocator metadata.
GnuTLS builds of Exim are uniquely exposed due to how they handle buffer allocation lifecycles.
OpenSSL builds do not share this specific code path and remain unaffected.
Debian, Ubuntu, and other GnuTLS-centric Linux distributions form the primary attack surface.
An unauthenticated network attacker requires only basic network access to port 25, 465, or 587.
No prior authentication, user interaction, or special configuration parameters are needed.
Once the heap metadata is successfully corrupted, attackers gain memory control primitives.
This memory manipulation capability can be leveraged to achieve remote code execution.
The exploit executes arbitrary payload commands under the privileges of the Exim service account.
This enables unauthorized mail theft, configuration tampering, and internal network lateral movement.
Public proof-of-concept exploits began circulating shortly after initial disclosure.
Security researchers named this high-severity threat variant “Dead.Letter”.
System administrators faced immediate risks of complete mail infrastructure compromise.
Vendor mitigation steps required immediate package upgrades to version 4.99.3 or higher.
Temporary workarounds involved disabling the CHUNKING extension via configuration adjustments.
Comprehensive defense-in-depth measures remain critical for protecting vulnerable mail servers globally.
DailyCVE Form:
Platform: Exim Mail Server
Version: Older than 4.99.3
Vulnerability: Use after free
Severity: Critical risk level
Date: May 12 2026
Prediction: Patched May 2026
(end of form)
What Undercode Say:
Bash Commands and Codes
Check Exim version exim -bV Check TLS library link ldd /usr/sbin/exim4 | grep gnutls Temporary workaround in configuration file echo "chunking_advertise_hosts =" >> /etc/exim4/update-exim4.conf.conf systemctl restart exim4 Update Exim package on Debian/Ubuntu apt update && apt install --only-upgrade exim4
Exploit: (Educational Purposes!)
The exploit targets the asynchronous teardown of the plaintext buffer during TLS closure while processing SMTP CHUNKING BDAT commands. By sending a TLS close_notify packet mid-stream, an attacker forces the server to free the buffer prematurely while the BDAT parser loop remains active. Injecting a crafted byte into this freed memory location overwrites allocator metadata. Subsequent heap operations leverage this corruption primitive to redirect execution flow and achieve remote code execution under the exim user account.
Protection:
To safeguard systems against CVE-2026-45185, administrators must immediately upgrade the Exim mail server package to version 4.99.3 or later, where the patch corrects the buffer lifecycle handling. If upgrading is immediately unfeasible, apply the temporary workaround by setting `chunking_advertise_hosts =` in the configuration file to disable BDAT advertising, thereby blocking the vulnerable code path. Additionally, restrict external SMTP access using firewall rules and monitor logs for anomalous connection resets or process crashes.
Impact:
Successful exploitation of CVE-2026-45185 grants unauthenticated remote code execution with the privileges of the Exim service account. This allows malicious actors to read, modify, or delete sensitive email communications, install persistent backdoors, compromise internal mail infrastructure, and pivot deeper into corporate or institutional networks. The flaw poses catastrophic risks to enterprises, healthcare networks, and governmental organizations relying on exposed public-facing mail servers.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
