CVE-2026-45185: Exim Use-After-Free in BDAT Body Parsing with GnuTLS
CVE-2026-45185 is a use-after-free in the BDAT body parsing path of Exim before 4.99.3, reachable over the network in certain GnuTLS configurations. The record describes possible heap corruption and arbitrary code execution by an unauthenticated attacker, with a CVSS 3.1 base score of 9.8 from cve@mitre.org. The record shows no KEV listing and no confirmed exploitation in the sources consulted.
Overview
CVE-2026-45185 affects Exim, a widely used mail transfer agent. According to the record, the flaw is a use-after-free (CWE-416) in the BDAT body parsing path, and it only appears in certain GnuTLS configurations. The record was published on 2026-05-12.
Impact
The record states that the flaw can lead to heap corruption and that an unauthenticated network attacker exploiting it could execute arbitrary code. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a base score of 9.8 from cve@mitre.org. The SSVC fields in the record mark exploitation as none, automatable as yes and technical impact as total.
Affected products and versions
- Product: Exim (Exim Exim)
- Affected range in the record: from 4.97 up to before 4.99.3
- Configuration condition: certain GnuTLS configurations
The record lists no separate fixed-version entry. Because the affected range ends before 4.99.3, upgrading to 4.99.3 or later would be the expected remediation, but this is an inference from the range and should be confirmed against the vendor advisory.
Exploitation status
The KEV field in the record is not listed, so no active exploitation is reported. The sources consulted show no confirmed exploitation. The EPSS probability is 0.00944 (percentile 0.60708) as of 2026-10-23, which indicates the estimated likelihood of exploitation within 30 days according to the EPSS model.
Remediation and mitigation
- Review the Exim security advisory and plan an upgrade of affected installations to 4.99.3 or later.
- Prioritize internet-facing mail servers and those that use GnuTLS, given the network reachability described in the record.
- If an upgrade cannot be applied immediately, consult the vendor advisory for any interim measures before making changes.
Detection guidance
- Inventory Exim versions and confirm whether the TLS library in use is GnuTLS.
- Monitor mail server logs and crash or restart events for unexpected service failures, which can indicate memory corruption.
- Review vendor and mailing-list sources for indicators as they are published.
Limitations of the available information
The record does not state which specific GnuTLS versions or configurations are affected, does not provide a fixed-version entry, and does not include a vendor-published exploit analysis. The record also contains a broken link to a vendor text file. Statements about the exact trigger conditions are kept at a high level on purpose.
Frequently asked questions
What is CVE-2026-45185?
It is a use-after-free in the BDAT body parsing path of Exim, reported in certain GnuTLS configurations. The record describes possible heap corruption and arbitrary code execution by an unauthenticated network attacker.
Which Exim versions are affected?
The record lists the affected range as from 4.97 up to before 4.99.3. Upgrading to 4.99.3 or later is the expected remediation, to be confirmed against the vendor advisory.
Is this vulnerability being actively exploited?
No. The KEV field is not listed, and the sources consulted show no confirmed exploitation.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.