CVE-2026-45185

The vulnerability occurs in the BDAT message body parsing path (CHUNKING mechanism) with specific GnuTLS configurations. The attacker sends a TLS close_notify signal during message body transfer (in the middle of a chunk), then transmits the final byte as cleartext within the same TCP connection. This unexpected transition leads to use-after-free of a heap memory area, causing heap corruption. The bug can be exploited to hijack control flow and execute arbitrary code.

An unauthenticated network attacker can execute arbitrary code on the server with Exim process privileges, which in practice means complete compromise of the mail server. Possible consequences include data disclosure and modification, malware installation, and use of the server as an entry point for further network infiltration.

Exim must be updated immediately to version 4.99.3 or later. Detailed patch information is available in the official security bulletin at https://exim.org/static/doc/security/CVE-2026-45185.txt and https://exim.org/static/doc/security/EXIM-Security-2026-05-01.1/. As a temporary workaround, consider disabling CHUNKING (BDAT) support or switching the TLS library if an immediate update is not possible.

Exim versions prior to 4.99.3 running with GnuTLS configuration (not all TLS configurations are vulnerable — a specific GnuTLS configuration with CHUNKING/BDAT support enabled is required).