Exim

CVE-2026-45185 "Dead.Letter": Exim use-after-free in BDAT/CHUNKING on GnuTLS builds, fixed in 4.99.3

The Exim maintainers published EXIM-Security-2026-05-01.1 (CVE-2026-45185, Critical, CVSS 9.8) on 2026-05-12 after a report from Federico Kirschbaum of XBOW on 2026-05-01: when a client sends a TLS close_notify alert before a BDAT body transfer is complete and follows it with a final byte in cleartext on the same TCP connection, Exim writes into a buffer already freed during the TLS teardown and corrupts the heap, and an attacker only needs to establish a TLS connection and use the CHUNKING (BDAT) extension (Exim advisory, 2026-05-12). Exim 4.97 up to and including 4.99.2 built with USE_GNUTLS=yes are affected, OpenSSL builds are not, and 4.99.3 fixes the flaw by resetting the input-processing stack when a TLS close notification arrives during a BDAT transfer; there is no known mitigation other than upgrading (Exim advisory, 2026-05-12). XBOW's write-up places the freed memory in Exim's TLS transfer buffer, into which the still-active BDAT receive wrapper's call to ungetc() writes a single newline, and notes that GnuTLS is the default TLS library on many Debian-based distributions, including Ubuntu (XBOW, 2026-05-12). During the disclosure window an LLM guided step by step by XBOW Native produced working exploits against non-PIE builds, first without ASLR and then with ASLR, the latter running its payload through Exim's ${run} expansion, which forks bash; against the default PIE build no full exploit was reported: the researcher's side got as far as leaking a stack address, while the LLM never got as far as a leak (XBOW, 2026-05-12).