{"id":170699,"date":"2026-05-15T06:24:37","date_gmt":"2026-05-15T04:24:37","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-exim-privodyashhaya-k-udalyonnomu-vypolneniyu-koda-na-servere"},"modified":"2026-05-15T06:24:37","modified_gmt":"2026-05-15T04:24:37","slug":"uyazvimost-v-exim-privodyashhaya-k-udalyonnomu-vypolneniyu-koda-na-servere","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-exim-privodyashhaya-k-udalyonnomu-vypolneniyu-koda-na-servere","title":{"rendered":"Vulnerability in Exim Leading to Remote Code Execution on Server","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A critical vulnerability (CVE-2026-45185) has been identified in the Exim mail server, allowing for remote code execution on the server. The issue occurs starting from the Exim 4.97 branch when compiled with the GnuTLS library (\"USE_GNUTLS=yes\") and has been resolved in the Exim 4.99.3 release. Builds using OpenSSL and other libraries different from GnuTLS are not affected by this vulnerability. <\/p>\n

The problem is caused by accessing already freed memory (use-after-free) in the GnuTLS backend and can be exploited when interacting with servers that support the \"ESMTP CHUNKING\" extension and the BDAT command for chunked message body transmission instead of sending it as an indivisible block using the DATA command. Memory corruption of the process occurs when the client initiates a premature TLS session termination using the close_notify command during the body transmission via BDAT and subsequently sends a single byte in plaintext within the same TCP connection. <\/p>\n

Upon receiving the close_notify command, the GnuTLS backend invokes the TLS session termination function, which frees the buffers associated with the session. Due to a coding error in the backend, even though the TLS buffer is freed, the BDAT handler continues to read data from the stream and calls the ungetc() function, which, when sending subsequent unencrypted data, results in writing one byte to an already freed buffer. This byte corrupts the metadata of the memory allocator in the heap, which has been exploited to create an exploit executing arbitrary code. server<\/a>. <\/p>\n

Initially, researchers generated a partially functioning exploit using AI, which enabled code execution but only worked under controlled environments on systems with ASLR and PIE protection disabled, and a specific version of the libc library. Subsequently, an attempt was made to create an exploit with human involvement, where some challenges were overcome, leading to the leakage of the stack address. However, the exploit was not completed by the scheduled disclosure date for the vulnerability. According to the researchers who identified the vulnerability, AI assistants are still not capable of creating exploits for complex products, but they hope that future researchers will be able to finalize their work and write a fully functioning exploit. <\/p>\n

Among major distributions, Exim versions 4.97+ are used in Debian 13, Ubuntu 24.04+, SUSE\/openSUSE, Arch Linux, Alpine Linux 3.19+, ALT Linux p11, ROSA, Gentoo, OpenWRT, Fedora, EPEL (Exim is not included in the standard RHEL repository), and FreeBSD. The Exim build with GnuTLS is used by default in Debian and Ubuntu, while in other distributions it requires confirmation. As a workaround to block the vulnerability, the CHUNKING extension can be disabled using the chunking_advertise_hosts setting in the configuration file.
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Exim \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-45185), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0442\u043a\u0438 Exim 4.97 \u043f\u0440\u0438 \u0441\u0431\u043e\u0440\u043a\u0435 \u0441 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u043e\u0439 GnuTLS («USE_GNUTLS=yes») \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Exim 4.99.3. \u0421\u0431\u043e\u0440\u043a\u0438 \u0441 OpenSSL \u0438 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u043c\u0438, \u043e\u0442\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u043e\u0442 GnuTLS, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0435\u043c \u043a \u0443\u0436\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0451\u043d\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (use-after-free) \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-170699","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerability in Exim leading to remote code execution on the server | ProHoster","description":"A critical vulnerability (CVE-2026-45185) has been identified in the Exim mail server, allowing remote code execution on the server.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-exim-privodyashhaya-k-udalyonnomu-vypolneniyu-koda-na-servere","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exim, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 | ProHoster","og:description":"\u0412 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Exim \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-45185), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-exim-privodyashhaya-k-udalyonnomu-vypolneniyu-koda-na-servere","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-15T04:24:37+00:00","article:modified_time":"2026-05-15T04:24:37+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/170699","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=170699"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/170699\/revisions"}],"predecessor-version":[{"id":170706,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/170699\/revisions\/170706"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=170699"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=170699"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=170699"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}