Cyber Resilience

CVE-2026-45185

Critical

Published: 12 May 2026

Published
12 May 2026
Modified
28 May 2026
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0123 65.1th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-45185 is a critical-severity Use After Free (CWE-416) vulnerability in Exim Exim. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 34.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on…

more

the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Remote unauthenticated RCE via crafted TLS+BDAT input on public-facing Exim SMTP server directly matches exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-67896Same product: Exim Exim
CVE-2025-30232Same product: Exim Exim
CVE-2026-40685Same product: Exim Exim
CVE-2026-40687Same product: Exim Exim
CVE-2026-40684Same product: Exim Exim
CVE-2025-26794Same product: Exim Exim
CVE-2026-41401Shared CWE-416
CVE-2026-3593Shared CWE-416
CVE-2024-45434Shared CWE-416
CVE-2025-70968Shared CWE-416

Affected Assets

exim
exim
4.97 — 4.99.3

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-416

Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.

References