CVE-2026-45185 – Exim GnuTLS Use-After-Free Remote Code Execution Vulnerability

CVE ID :CVE-2026-45185

Published : May 12, 2026, 8:16 p.m. | 42 minutes ago

Description :Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…