CVE-2026-45185

Executive Summary

CVE-2026-45185 is a critical, remotely exploitable use-after-free vulnerability in Exim versions prior to 4.99.3, specifically within the BDAT body parsing path when Exim is built with certain GnuTLS configurations. An unauthenticated network attacker can trigger heap corruption by exploiting a race condition involving a TLS close_notify message mid-body during a CHUNKING (BDAT) transfer, followed by a cleartext byte on the same TCP connection, potentially leading to arbitrary code execution. With a CVSS score of 9.8 and EPSS percentile in the top ~34% of known exploited vulnerabilities, this flaw represents a significant risk to internet-facing mail servers running vulnerable Exim builds.

Technical Analysis

The vulnerability resides in the interaction between the TLS layer and the BDAT (Body Data) command handling within Exim's SMTP transaction logic. Exim, when compiled with GnuTLS as the TLS library, processes incoming SMTP data through a state machine that tracks both TLS state and message body state.

The bug is triggered through the following mechanism:

1. TLS State Management: Exim's GnuTLS integration uses a callback (or equivalent) to determine whether the current input buffer contains TLS-encrypted data or cleartext. This state is stored internally and consulted on each read operation.

2. BDAT Processing: When a client issues a BDAT command (RFC 3030, CHUNKING), Exim enters a body-receiving state where it streams data to the message file descriptor. The BDAT parser tracks the number of bytes expected per chunk.

3. The Race Condition: An attacker sends a TLS close_notify alert mid-body, i.e., while the BDAT parser is still expecting more bytes. GnuTLS processes the close_notify and marks the underlying TLS session as closed (state == TLS_OK becomes false). However, because the BDAT body state machine is still active, Exim's SMTP loop does not immediately switch to the "cleartext" mode.

4. Use-After-Free: When the attacker then sends a single cleartext byte (following the TLS close_notify on the same TCP connection), the code path handling input reads uses a pointer that was freed when the GnuTLS session was torn down. Specifically, the buffer that held TLS-decrypted data is released, but the BDAT parser holds a stale pointer to it. Reading from this freed memory leads to heap corruption — writing decoded SMTP data into a freed chunk, overwriting adjacent heap metadata or allocated objects.

The root cause is the lack of proper synchronization between Exim's TLS state machine and the BDAT body-parsing state machine. The code paths were written assuming TLS state transitions only occur at message-level boundaries (e.g., between SMTP commands), not mid-message-body. This assumption fails under a maliciously crafted interaction.

Attack Surface: The vulnerability is reachable remotely over SMTP port 25 (and potentially submission ports 465/587 with TLS). It requires no authentication — only the ability to establish a TCP connection and perform a partial SMTP conversation with STARTTLS or implicit TLS. The attack succeeds only when Exim is built with GnuTLS; builds using OpenSSL are not affected per the NVD description.

The heap corruption primitive is powerful: an attacker controls the size and content of the freed buffer's overwrite, potentially enabling arbitrary write primitives, function pointer overwrites, or allocation alignment attacks — all in the context of the Exim daemon process, which typically runs as root or a privileged mail user.

Exploitation Scenarios

Scenario 1: Remote Code Execution on a Public SMTP Server

1. Reconnaissance: The attacker performs an SMTP banner grab on port 25 using nc -zv target 25 and inspects the banner (220 hostname ESMTP Exim 4.9x). They confirm GnuTLS usage by sending EHLO test, then STARTTLS, and observing that the server offers TLS. Alternatively, Shodan dorks such as product:"exim" port:"25" identify candidate targets en masse. The attacker also checks EXIM_VERSION via the EHLO response.

2. Weaponization: The attacker crafts a custom TLS client (using Python's ssl module or GnuTLS bindings) that:

   • Connects to port 25
   • Sends EHLO attacker.com
   • Sends STARTTLS, completes the TLS handshake
   • Sends MAIL FROM:<> and RCPT TO:<victim@target>
   • Sends BDAT 100000 (indicating it will send 100,000 bytes of body data)
   • Sends 50,000 bytes of benign body data over TLS
   • Sends a TLS close_notify alert using SSL_write(... w/ SSL_SEND_SHUTDOWN) or low-level GnuTLS gnutls_bye()
   • Immediately sends a raw cleartext byte (e.g., \x41) on the same TCP socket without waiting for a new TLS handshake

3. Trigger: The cleartext byte hits the freed TLS buffer. The BDAT parser dereferences the stale pointer, writing the byte into freed memory. If the attacker has previously sprayed the heap (by sending many mail interactions with specific body content patterns), the freed chunk may be allocated to a controlled object. With repeated attempts (spraying 100+ connections with varying payload lengths), the attacker achieves reliable heap grooming, eventually overwriting a function pointer or return address.

4. Payload Execution: The attacker sends a small ROP chain or shellcode via the cleartext byte sequence (converting the single-byte limitation into a multi-byte payload by triggering the bug repeatedly with different offsets, or by using the heap corruption to hijack control flow). Typical payloads: bind shell on high port (e.g., 4444), reverse shell to attacker infrastructure, or LD_PRELOAD-based persistence.

5. Post-Exploitation: The attacker gains code execution as the exim user (or root, depending on configuration). They extract /etc/shadow, mail spools, and TLS private keys. They attempt privilege escalation via SUID binaries or kernel exploits. The server is then used for spam relay, credential harvesting, or as a pivot point into the internal network.

Scenario 2: Partial Denial of Service as a Precursor

1. The attacker uses the same trigger technique but without heap grooming. The corrupted heap causes Exim to crash with SIGSEGV.
2. They repeat the DoS across a cluster of mail servers, knocking out email services for the organization — a precursor to a phishing campaign or to degrade incident response capabilities.

Note: Only remotely reachable on GnuTLS builds. OpenSSL builds are not vulnerable.

Impact Assessment

Business Impact: Email is a critical business service. Successful exploitation grants full control of the mail server — enabling interception of all inbound/outbound mail, credential harvesting via mail content, and lateral movement into the organization's trust domain.

Technical Impact: CVSS v3.1 base score of 9.8 (Critical) reflects:

• Attack Vector: Network (AV:N) — remotely exploitable
• Attack Complexity: Low (AC:L) — no special conditions required beyond partial SMTP conversation
• Privileges Required: None (PR:N) — unauthenticated
• User Interaction: None (UI:N) — no victim action needed
• Confidentiality/Integrity/Availability: High/High/High — full compromise possible

Blast Radius: Any Exim server version < 4.99.3 built with GnuTLS. This includes many Debian/Ubuntu-derived mail servers, as Debian defaults Exim to GnuTLS. Internet-facing SMTP servers on ports 25, 465, 587 are all exposure points. The EPSS score of 0.01225 (65.9th percentile) indicates active exploit research interest.

CISA KEV Status: Not listed (as of reporting date) — but this is not a reliable indicator of "safe", as KEV lags active exploitation.

Business Continuity Risk: Mail server downtime (crash) directly impacts customer communication, order confirmations, and support tickets. Data breach disclosures may trigger regulatory fines (GDPR, HIPAA) and reputational damage.

Detection Guidance

Sigma Rule

title: Exim TLS Close-Notify Followed by Cleartext - Suspicious SMTP Behavior
id: 8f3a2d9e-6c41-4e8b-9b2c-1a5f3d7e4b01
status: experimental
description: Detects TLS session shutdown mid-message-body followed by cleartext data, indicative of CVE-2026-45185 exploitation attempt.
author: Valtersit Threat Intelligence Team
date: 2026/06/15
logsource:
  category: application
  product: exim
  service: mainlog
detection:
  selection_bdat:
    keywords:
      - 'BDAT'
  selection_tls_error:
    keywords:
      - 'TLS error on connection'
      - 'gnutls'
      - 'SSL_accept'
      - 'shutdown'
  selection_cleartext:
    keywords:
      - 'unexpectedly closed'
      - 'unexpected disconnection'
      - 'SMTP connection from'
  condition: selection_bdat and selection_tls_error and selection_cleartext
  timeframe: 5s
falsepositives:
  - Legitimate clients disconnecting mid-large-message with broken TLS stacks
level: high
tags:
  - attack.t1190
  - cve.2026.45185
  - cwe.416

YARA Rule

rule exim_cve_2026_45185_payload
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects heap spray payload patterns for CVE-2026-45185"
        date = "2026-06-15"
        cve = "CVE-2026-45185"
    strings:
        // Heap spray pattern: repeated NOP sleds or RWX memory string patterns
        $s1 = "\x90\x90\x90\x90\x90\x90\x90\x90" ascii
        $s2 = "\x41\x41\x41\x41" ascii
        // Common x64 ROP gadgets (pop rdi; ret)
        $s3 = { 5f c3 }
        // Linux bind shell (port 4444) pattern
        $s4 = { 6a 5a 58 99 52 5e 6a 01 5f 6a 02 59 0f 05 }
        $s5 = "BDAT" ascii
    condition:
        filesize < 2MB and
        any of ($s1, $s2) and
        (uint16(0) == 0x5a4d or uint16(0) == 0x457f) and
        any of ($s3, $s4, $s5)
}

Suricata IDS Rule

alert tcp any any -> any 25 (msg:"ET EXPLOIT Exim CVE-2026-45185 TLS Close-Notify Mid-BDAT Attempt"; flow:to_server,established; content:"BDAT|20|"; within:100; content:"|01 00 00|"; within:5; distance:50; content:"|15 03|"; within:5; distance:10000; sid:2034518; rev:1; metadata:created_at 2026_06_15, cve CVE_2026_45185, mitre_tactic TA0001, mitre_technique T1190, signature_severity Critical; reference:url,valtersit.com/CVE-2026-45185;)

Elastic Detection

// EQL to detect abnormal TLS termination during SMTP BDAT
sequence by source.ip, destination.ip
  with maxspan=5s
  [ network where network.protocol == "smtp" and
      event.category == "network" and
      startsWith(network.transport, "tcp") and
      dns.question.name == null ]
  [ network where network.protocol == "tls" and
      event.category == "network" and
      tls.resumed == false and
      event.action == "tls_alert" ]
  [ network where network.protocol == "smtp" and
      event.category == "network" and
      not network.transport in ("tls", "ssl") ]

Splunk SPL Query

index=proxy OR index=firewall earliest=-7d
| where match(c_ip, "^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+$")
| search "25" OR "465" OR "587" 
| rex field=_raw "BDAT\s+(?<bdat_size>\d+)"
| rex field=_raw "(?i)(tls|ssl).{0,10}(alert|close|shutdown)"
| rex field=_raw "(?i)(cleartext|plaintext|raw)"
| stats count by src_ip, dest_ip, parsed_data
| where count > 3 and bdat_size > 0 and (tls_alert = "true" or ssl_close = "true") 
| table _time, src_ip, dest_ip, bdat_size, count, _raw
| sort - _time

Wazuh OSSEC Rule

<group name="exim,">
  <rule id="204518" level="15" frequency="5" timeframe="60">
    <decoded>exim</decoded>
    <match>BDAT</match>
    <match>gnutls</match>
    <match>unexpected</match>
    <description>Exim CVE-2026-45185: Possible TLS close_notify mid-BDAT trigger detected.</description>
    <group>attack.t1190,cve.2026.45185,pci_dss_6.5.2,</group>
    <mitre>
      <tactic>T1190</tactic>
      <technique>Exploit Public-Facing Application</technique>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — Debian has claimed a patch exists in Exim 4.99.3 for this issue. However, this is a single-source claim and has not been independently verified by the CVE governing body or a second distributor. Validate the patch before deployment.

1. Immediate Mitigations (no patch available yet)

• Restrict Unauthenticated SMTP: Use acl_smtp_mail and acl_smtp_rcpt rules to require authenticated connections for all valid recipients. This does not stop the initial exploit but reduces the attack surface for anonymous relays.
• Disable CHUNKING Extension: In Exim's config, remove any EHLO extension advertising by setting chunking_advertise_hosts = (empty). This disables BDAT command support entirely, making the vulnerable code path unreachable. Note: This breaks RFC 3030 functionality and may affect interoperability with clients that use chunked mail transfer.
• Network-Level Blocking: Use a WAF/IPS in front of mail servers to drop packets matching the Suricata rule above. This is a stopgap — TLS-encrypted traffic will not be inspected.
• Resource Limits: Set smtp_accept_max and smtp_accept_max_per_host to low values to limit the number of concurrent exploitable connections.

2. Patch / Upgrade Steps

• Upgrade to Exim 4.99.3 or Later: If the Debian patch is confirmed, run:

  apt update && apt upgrade exim4
  

  On other distributions:

  # Build from source after verifying the 4.99.3 tarball checksums
  wget https://www.exim.org/exim-4.99.3.tar.gz
  tar xzf exim-4.99.3.tar.gz
  cd exim-4.99.3
  make -j$(nproc)
  make install
  

• Verify Build Configuration: Confirm your Exim was built with USE_GNUTLS:

  strings /usr/sbin/exim | grep -i gnutls
  

  If built with OpenSSL instead, this CVE does not apply (but other CVEs may).

3. Long-Term Hardening

• Switch to OpenSSL Build: If possible, rebuild Exim with OpenSSL for TLS instead of GnuTLS. This eliminates this vulnerability class immediately and has no functional impact. On Debian, set USE_GNUTLS=no in Local/Makefile and rebuild.
• Enable Address Space Layout Randomization (ASLR): Ensure Exim runs with full ASLR (Linux kernel randomize_va_space=2). Heap spraying becomes significantly harder, though not impossible.
• Regular Patch Cadence: Subscribe to Exim security announcements and Debian security notices. This vulnerability underscores the importance of no-trust mail server patching.
• Network Segmentation: Place mail servers in a DMZ with no direct access to internal application servers. Limit egress traffic to required ports (25, 465, 587 outbound).
• Monitoring: Use the detection rules above in your SIEM/IDS. Correlate Exim mainlog errors with network flow data.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-45185
2. Debian Security Announcement: https://www.debian.org/security/2026/dsa-XXXX (pending confirmation)
3. Exim Official Distribution: https://www.exim.org/
4. RFC 3030 (SMTP CHUNKING/BDAT): https://datatracker.ietf.org/doc/html/rfc3030
5. CWE-416 Reference: https://cwe.mitre.org/data/definitions/416.html

Threat Actor Activity: No known exploit-in-the-wild evidence as of the reporting date. However, the EPSS score (0.01225, 65.9th percentile) and the low complexity of triggering the flaw suggest active research interest. The CVSS 9.8 rating will draw attention from commodity exploit developers. Monitor Exim mailing lists and research publications for emerging exploit code.