# CVE-2026-45185

> Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.

- **CVSS:** 9.8 (CRITICAL)
- **EPSS:** 0.1%
- **CWE:** CWE-416

Canonical: https://intel.threadlinqs.com/cve/CVE-2026-45185
Full threat coverage + IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp