Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2026-45185 EUVD-2026-29824GHSA-fhg4-whcv-f8v4

Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggere…

Published May 12, 2026 · Updated May 14, 2026 · Assigned by mitre

Vendor: Exim Product: Exim Package: exim Package: exim-cdb Package: exim-dbmdb Package: exim-dnsdb Package: exim-doc Package: exim-mysql Package: exim-pgsql Package: exim-scripts Package: exim-sqlite Package: exim-utils Package: exim4 Package: exim4 Ecosystem: Debian Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.

Affected products

VendorProductAffectedFixed
Exim Exim 4.97 – < 4.99.3 4.99.3

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 exim4 4.99.2-2 —
Debian 13 exim4 4.98.2-1+deb13u2 —
Debian 12 exim4 4.96-15+deb12u9 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS exim4 4.99.1-1ubuntu1.2 —
Ubuntu 25.10 exim4 4.98.2-1ubuntu2.2 —
Ubuntu 24.04 LTS exim4 4.97-4ubuntu4.5 —
Ubuntu 22.04 LTS exim4 4.95-4ubuntu2.8 —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS exim4 4.93-13ubuntu1.12+esm1 USN-8382-1
Ubuntu Pro 18.04 LTS exim4 4.90.1-1ubuntu1.10+esm6 USN-8382-1
Ubuntu Pro 16.04 LTS exim4 4.86.2-2ubuntu2.6+esm9 USN-8382-1
Ubuntu Pro 14.04 LTS exim4 4.82-3ubuntu2.4+esm9 USN-8382-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling exim +9 4.99.5-r0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 4 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 3

References