Exim BDAT flaw makes mail servers urgent RCE patch targets

CVE-2026-45185 is the kind of bug that forces defenders to remember an old lesson: email infrastructure is still high-risk edge infrastructure. Exim has disclosed a remotely reachable use-after-free bug in its BDAT message-body parsing path that can lead to heap corruption and potential remote code execution when affected deployments use GnuTLS.

That matters because Exim often sits on internet-facing mail relays, submission servers, and internal transfer infrastructure that may not receive the same patch urgency as web gateways, VPN appliances, or identity services. In reality, a critical vulnerability on a mail transport agent can become just as operationally serious.

What happened

According to Exim's security advisory, the flaw is triggered during BDAT body handling when a client sends a TLS close_notify before the transfer is complete and then follows up with one final cleartext byte on the same TCP connection. In affected builds, that sequence can cause Exim to write into a buffer that was already freed during TLS teardown.

The advisory says all Exim versions from 4.97 through 4.99.2 are affected if they were built with USE_GNUTLS=yes. Builds using OpenSSL or other TLS libraries are not impacted by this specific issue. Exim fixed the problem in version 4.99.3 and says there is no known mitigation other than upgrading.

XBOW's technical write-up helps explain why the story deserves attention. The bug may begin as a one-byte write into freed memory, but the researchers show how that small corruption primitive can still be developed into a serious exploit path under the right conditions.

Why defenders should care

This is not only about one SMTP edge case. It is about where the bug lives. Mail servers are still among the most exposed services many organizations run, and they often maintain trusted paths into internal infrastructure, security tooling, and identity-linked workflows.

If an attacker can achieve remote code execution on a mail relay, the impact may include:

takeover of a business-critical internet-facing service
visibility into mail flow, routing, and message-handling logic
staging for follow-on lateral movement into adjacent systems
broader containment and credential-review work during incident response

Even when a mail server does not store the most sensitive data directly, it often occupies a strategically useful network position. That is why strong segmentation, least privilege, and limited administrative trust around mail infrastructure still matter.

The real operational risk

The most important part of this story is exposure plus neglect. Many organizations still think of email infrastructure as mature, boring, and relatively stable. That mindset is dangerous when the service is both internet-facing and operationally essential.

CVE-2026-45185 is a reminder that “legacy but stable” can quickly become “quietly critical and under-protected.” If an affected Exim deployment is exposed externally and built against GnuTLS, defenders should treat the patch as urgent rather than waiting for a routine maintenance cycle.

The lack of a practical workaround raises the pressure further. This is not a case where teams can safely rely on a configuration toggle, temporary feature disablement, or a compensating control to buy time. If the vulnerable build is present, the durable fix is to move to 4.99.3.

What defenders should do now

1. Identify every Exim deployment and check the TLS backend

Start with asset discovery. Confirm where Exim is running, which versions are in use, and whether the build uses GnuTLS rather than OpenSSL. The vulnerable condition is not simply “Exim exists,” but “Exim 4.97-4.99.2 with USE_GNUTLS=yes.”

2. Upgrade exposed systems to Exim 4.99.3 as a priority

Exim's own guidance is clear: upgrade. Because the vendor says there is no known mitigation other than patching, externally reachable mail systems should move to the front of the remediation queue.

3. Recheck segmentation and trust boundaries around mail infrastructure

A patched server is better than an unpatched one, but this is also a good time to verify network segmentation, admin-path restrictions, and monitoring around mail relays. Services that ingest hostile traffic from the internet should not have easy paths to high-value internal assets.

4. Hunt for suspicious SMTP and TLS behavior

Review logs, telemetry, and network data for unusual SMTP sessions, malformed or abnormal BDAT usage, odd TLS shutdown patterns, and any signs of instability or crashes on Exim hosts. Even absent confirmed exploitation, this is a case where targeted retrospective review is worth the effort.

5. Update the organization's edge-service patch assumptions

If mail servers are still classified operationally as low-churn infrastructure rather than critical edge systems, change that. The broader lesson is that internet-facing “old core services” still deserve fast patch SLAs and regular exposure review.

Strategic takeaway

CVE-2026-45185 is a useful stress test for patch discipline around services that organizations stop thinking about. Exim is not flashy, but it is exposed, trusted, and deeply operational. That combination is exactly why a remote code execution path on mail infrastructure deserves immediate attention.

Teams that respond well here will do more than patch one daemon. They will use this moment to tighten visibility, ownership, and defensive expectations around all edge services that quietly sit in the blast radius.

Is every Exim deployment affected?

No. The issue affects Exim versions 4.97 through 4.99.2 when the software is built with GnuTLS. Exim builds using other TLS libraries such as OpenSSL are not affected by this specific flaw.

Is there a workaround if teams cannot patch immediately?

Exim's advisory says there is no known mitigation other than upgrading to version 4.99.3.

Why is this more than just a mail-server bug?

Because mail relays are often internet-facing, business-critical, and strategically placed inside enterprise environments. A compromise there can create a meaningful operational foothold.

Exim BDAT flaw makes mail servers urgent RCE patch targets