Security updates released for Exim Mail Transfer Agent (MTA) and addressed multiple possible remote-triggered critical vulnerabilities allowing RCE.

The flaw affected outdated Exim deployments. It is a user-after-free (UAF) flaw triggered during the TLS shutdown while handling BDAT chunked SMTP traffic.

Exim is a widely used open-source mail transfer agent deployed across enterprise, ISP, academic, and government infrastructures for internet-connected Unix systems. CVE-2026-45185 was discovered and reported by XBOW researcher Federico Kirschbaum. It impacts Exim versions 4.97 through 4.99.2 on builds compiled with GnuTLS that have STARTTLS and CHUNKING advertised. OpenSSL-based builds are not affected.

The Exim Project has confirmed

• All versions prior to 4.99.3 are obsolete.
• Legacy 3.x versions are more than 20 years outdated and should no longer be used.
• Version 4.99.3 is the latest security release addressing remotely triggerable issues.

The vulnerability impacts some Exim versions before 4.99.3 that use the default GNU Transport Layer Security (GnuTLS) library for secure communication. It is a user-after-free (UAF) flaw triggered during the TLS shutdown while handling BDAT chunked SMTP traffic.

There is a great deal of flexibility in the way mail can be routed, and there are extensive facilities for checking incoming mail. Exim can be installed in place of sendmail, although the configuration of Exim is quite different.

Vulnerability Exploitation

Attackers exploiting the vulnerability could execute commands on the server as well as access Exim data and emails, and potentially pivot further into the environment depending on server permissions and configuration.

Findings from EXBOW research:

 XBOW Native successfully produced a working exploit for a simplified target Exim server that had no Address Space Layout Randomization (ASLR) and non-PIE (Position Independent Executables) binary.

In a second attempt, the LLM achieved an exploit on a machine with ASLR, but still a non-PIE binary.

“[…] instead of continuing to attack glibc’s allocator with off-the-shelf mechanisms, XBOW Native had taken on Exim’s own allocator,” XBOW researchers say.

Despite the surprising result below, it was the human researcher who won the race, with assistance from the LLM for tasks such as assembling files and testing exploitation avenues.

Threat actors commonly target internet-facing mail transfer agents due to their direct exposure to external networks and critical role in enterprise communication infrastructure.

Threat Context

Security Area	Details
Product	Exim Mail Transfer Agent (MTA)
Current Secure Version	4.99.3
Affected Versions	All versions prior to 4.99.3
Legacy Risk	Exim 3.x releases are obsolete
Attack Surface	Internet-facing SMTP services
Potential Impact	Remote exploitation, mail service compromise, unauthorized access

Indicators of Concern (IoCs / Risk Indicators)

Type	Indicator	Description
Network Activity	Unusual SMTP connections	Suspicious external mail interactions
Service Behaviour	Unexpected Exim crashes/restarts	Possible exploitation attempts
Log Activity	Unauthorized mail relay events	Potential abuse of mail routing
Authentication	Unknown SMTP authentication attempts	Credential abuse indicators
System Activity	Unexpected child process execution	Possible remote code execution attempts

Mitigations

• Upgrade all Exim installations to version 4.99.3 immediately.
• Identify and decommission obsolete Exim 3.x deployments.
• Restrict unnecessary external exposure of SMTP services.
• Audit mail server configurations and relay permissions.

For users of Ubuntu and Debian-based Linux distributions should apply the available Exim updates (v4.99.3) through their package managers.

Sources: Exim Remote Code Execution Vulnerability

Sources: New critical Exim mailer flaw allows remote code execution