New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution

Summary: Exim released security updates for CVE-2026-45185, a use-after-free flaw in BDAT message body parsing rated CVSS 9.8 and nicknamed Dead.Letter, affecting versions 4.97 through 4.99.2 built with USE_GNUTLS=yes. Triggered when a client sends a TLS close_notify alert before body transfer completes and then a final cleartext byte on the same connection, the bug causes a one-byte write into freed memory that corrupts allocator metadata; it was reported by XBOW's Federico Kirschbaum on May 1, 2026, and fixed in version 4.99.3 with no available mitigations.
Key Takeaway: An attacker needs only the ability to open a TLS connection and use the CHUNKING (BDAT) SMTP extension, with almost no special server configuration, and Exim states there are no mitigations that resolve the issue - only the upgrade to 4.99.3.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2017-16943 CVE-2026-45185
Related: ⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026