CVE-2026-45185

As of 2026-05-14, CVE-2026-45185 is a CVSS 9.8 (CRITICAL-severity) vulnerability. EPSS exploitation probability 0.1%. Threadlinqs Intelligence tracks 1 threat exploiting it.

Last updated: 2026-05-14

Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.

CVSS v3 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-416

Threats tracking this CVE

• Dead.Letter — CVE-2026-45185 Unauthenticated Pre-Auth RCE in Exim via Use-After-Free in BDAT/GnuTLS — CRITICAL

References

• https://exim.org/
• https://code.exim.org/exim/wiki/wiki/EximSecurity
• https://exim.org/static/doc/security/CVE-2026-45185.txt
• https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim
• https://news.ycombinator.com/item?id=48111748
• https://www.openwall.com/lists/oss-security/2026/05/12/4
• https://exim.org/static/doc/security/EXIM-Security-2026-05-01.1/

← all vulnerabilities · Markdown version · Threadlinqs Intelligence

Enriched from CVE.org, NVD (this product uses the NVD API but is not endorsed or certified by the NVD), FIRST EPSS, CISA KEV, and GitHub Security Advisories.