A critical vulnerability has been identified in the Exim mail server (CVE-2026-45185), allowing remote execution of code on the server. The issue occurs starting from Exim version 4.97 when compiled with the GnuTLS library ('USE_GNUTLS=yes') and has been fixed in Exim version 4.99.3. Builds with OpenSSL and other libraries not using GnuTLS are not affected by this vulnerability.
The problem is caused by a use-after-free error in the GnuTLS backend and can be exploited by interacting with servers that support the 'ESMTP CHUNKING' extension and the BDAT command to transfer parts of a message body instead of sending it as an indivisible block using the DATA command. Memory corruption happens when a client prematurely terminates the TLS session using the close_notify command while transferring the message body via BDAT and then sends one byte unencrypted in the same TCP connection.
Upon receiving the close_notify command, the GnuTLS backend invokes the TLS session termination function, which frees the buffers associated with the session. Due to a coding error in the backend, even though the TLS buffer is freed, the BDAT handler continues to read data from the stream and calls the ungetc() function, which, when sending subsequent unencrypted data, results in writing one byte to an already freed buffer. This byte corrupts the metadata of the memory allocator in the heap, which has been exploited to create an exploit executing arbitrary code. server.
Initially, researchers generated a partially functioning exploit using AI, which enabled code execution but only worked under controlled environments on systems with ASLR and PIE protection disabled, and a specific version of the libc library. Subsequently, an attempt was made to create an exploit with human involvement, where some challenges were overcome, leading to the leakage of the stack address. However, the exploit was not completed by the scheduled disclosure date for the vulnerability. According to the researchers who identified the vulnerability, AI assistants are still not capable of creating exploits for complex products, but they hope that future researchers will be able to finalize their work and write a fully functioning exploit.
Among major distributions, Exim versions 4.97+ are used in Debian 13, Ubuntu 24.04+, SUSE/openSUSE, Arch Linux, Alpine Linux 3.19+, ALT Linux p11, ROSA, Gentoo, OpenWRT, Fedora, EPEL (Exim is not included in the standard RHEL repository), and FreeBSD. The Exim build with GnuTLS is used by default in Debian and Ubuntu, while in other distributions it requires confirmation. As a workaround to block the vulnerability, the CHUNKING extension can be disabled using the chunking_advertise_hosts setting in the configuration file.
Source: opennet.ru
