New Exim BDAT GnuTLS Vulnerability Enables Code Execution Attacks

A critical, stealthy vulnerability is lurking deep within Exim, the software powering a massive share of the world’s email infrastructure.

Sitting exposed on the internet’s front lines, these message transfer agents are highly lucrative targets for ruthless threat actors.

This newly unmasked memory corruption flaw arms attackers with the terrifying ability to remotely execute malicious code and completely hijack unpatched systems, potentially turning trusted mail servers into weaponized assets in a matter of keystrokes.

Exim BDAT GnuTLS Flaw

Tracked under the identifier EXIM-Security-2026-05-01.1 (with a CVE pending), the vulnerability is a remote Use-After-Free (UAF) flaw.

Federico Kirschbaum of XBOW Security initially reported the issue to the Exim maintainers on May 1, 2026.

The security gap lies in how Exim handles BDAT (CHUNKING) message-body transfers during an active session.

To trigger the exploit, an attacker must establish a standard TLS connection and utilize the CHUNKING SMTP extension.

Before the message body transfer completes, the attacker sends a TLS close_notify alert.

By immediately following up with a single cleartext byte on the same TCP connection, the attacker forces Exim to write data to a memory buffer that was already freed during the TLS teardown.

This specific sequence of events corrupts the heap memory. In an enterprise environment, remote attackers can leverage this heap corruption to execute malicious code and potentially take over the mail server.

Not all Exim deployments are vulnerable to this attack. The specific conditions for exposure include:

• Vulnerable builds range from Exim 4.97 to 4.99.2.
  
• The flaw exclusively impacts installations compiled with the GnuTLS backend enabled (USE_GNUTLS=yes).
  
• Servers using OpenSSL or other TLS libraries remain secure and are not affected by this Use-After-Free bug.

Exim maintainers coordinated a public release of the fix on May 12, 2026, giving distributors with restricted access a few days’ notice beforehand.

Because there are no known mitigations or configuration workarounds for this vulnerability, upgrading is the only effective defense.

Administrators must immediately update their affected mail servers to Exim version 4.99.3.

The security patch resolves the issue by ensuring the input processing stack cleanly resets whenever a TLS close notification interrupts an active BDAT transfer.

This architectural fix successfully prevents stale pointers from being accessed or written to during session teardowns.

The updated release is currently available on Exim’s official FTP servers and code repositories.