onyx --cves cve-2026-45185
CVE-2026-45185
- score
- 0.6
- cvss
- 9.8
- epss
- 0.9%
- published
- 2026-05-12
- kev added
- —
- first seen
Exim < 4.99.3 contains a use-after-free caused by improper handling of TLS close_notify mid-body during CHUNKING transfer in BDAT body parsing, letting unauthenticated remote attackers execute arbitrary code.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
- Public PoC
Exploit availability
Public PoC flagged by vulnx; no direct exploit link among the citations.
Weaknesses
References 8
- https://news.ycombinator.com/item?id=48111748
- https://www.openwall.com/lists/oss-security/2026/05/12/4
- https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim
- http://www.openwall.com/lists/oss-security/2026/05/12/25
- https://code.exim.org/exim/wiki/wiki/EximSecurity
- https://exim.org
- https://exim.org/static/doc/security/CVE-2026-45185.txt
- https://exim.org/static/doc/security/EXIM-Security-2026-05-01.1/