CVE-2026-45185
CRITICALExim 4.97-4.99.2 - Unauthenticated Use-After-Free via TLS Close Notify During CHUNKING Transfer
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2026-45185. PoCs published by SecureWithUmer, MJ-bin, materaj2.
AI-analyzed exploit summary This repository contains a functional proof-of-concept (PoC) for CVE-2026-45185, a use-after-free vulnerability in Exim 4.97-4.99.2 with GnuTLS. The exploit demonstrates a split BDAT payload across TLS close_notify and plaintext on the same SMTP connection, triggering a stale TLS callback issue leading to a potential use-after-free condition.
Description
Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.
Exploits (4)
This repository contains a functional proof-of-concept (PoC) for CVE-2026-45185, a use-after-free vulnerability in Exim 4.97-4.99.2 with GnuTLS. The exploit demonstrates a split BDAT payload across TLS close_notify and plaintext on the same SMTP connection, triggering a stale TLS callback issue leading to a potential use-after-free condition.
This repository provides a detailed technical analysis of CVE-2026-45185, focusing on a potential use-after-free (UAF) vulnerability in Exim's SMTP handling during TLS session termination. It includes a walkthrough of the vulnerable code paths, reader model changes, and the conditions required to trigger the issue.
The repository contains a Nuclei template for detecting Exim servers vulnerable to CVE-2026-45185, a use-after-free vulnerability in BDAT body parsing during TLS shutdown. The template safely checks for vulnerable versions and required capabilities (STARTTLS and CHUNKING) without triggering the exploit.
The repository contains a shell script designed to detect whether a Linux system is vulnerable to CVE-2026-45185, a use-after-free vulnerability in Exim's BDAT message body parsing when using GnuTLS. The script performs a series of checks to determine the presence and configuration of Exim, its version, TLS library linkage, and system mitigations.
References (8)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H