Description

Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-19T23:17:10.973Z",
  "pubdate": "2026-09-19T23:17:10.973Z",
  "executiveSummary": "A critical use-after-free vulnerability exists in Exim versions prior to 4.100.1 when specific non-default TLS configurations are utilized in conjunction with the GnuTLS library.\nThis memory corruption vulnerability allows an attacker to manipulate the application's memory management state, potentially leading to arbitrary code execution, unauthorized information disclosure, or application instability in the form of a denial-of-service.\nThe flaw originates from improper handling of memory objects during the TLS handshake or session termination phase when GnuTLS is active.\nThe vulnerability is exploitable remotely by an unauthenticated attacker who initiates a specially crafted TLS connection to the Exim service.\nSuccessful exploitation requires the deployment of non-default TLS settings, making the impact contingent upon the specific configuration of the MTA (Mail Transfer Agent).\nGiven Exim's role as a primary mail handling component, this flaw presents a high risk to the confidentiality and integrity of message data, as well as the availability of the mail delivery infrastructure.",
  "technicalDetails": "The root cause of this vulnerability is a use-after-free condition triggered within the GnuTLS integration layer of the Exim mail transfer agent. When Exim is configured with specific non-default TLS settings, the internal state machine responsible for managing TLS sessions fails to correctly track the lifecycle of memory buffers or pointers associated with session data.\nDuring the TLS handshake process or session teardown, a pointer to a GnuTLS object or buffer is freed prematurely. Due to logic errors in the code path handling these specific configurations, the application later attempts to dereference this dangling pointer to perform read or write operations. This typically occurs because the application continues to reference memory that has already been returned to the heap allocator, allowing for a race condition or a logic flaw where the pointer remains valid in the program's register or stack context despite being marked as free in the heap management structure.\nThe attack flow begins with an attacker initiating a TLS-encrypted connection to the Exim service. The attacker sends a sequence of maliciously crafted TLS frames or session resumption requests that exploit the discrepancy between the GnuTLS state and the Exim session management layer. By carefully orchestrating the timing and the structure of the TLS handshake, the attacker forces the application to re-allocate the freed memory block for other purposes, such as user-controlled input or structural data.\nOnce the memory has been re-allocated, the subsequent use of the dangling pointer by the Exim process allows the attacker to influence the application's control flow. By overwriting the contents of the re-allocated memory, an attacker may achieve arbitrary code execution by redirecting function pointers or modifying sensitive data structures stored within the heap. In scenarios where code execution is not achieved, the corrupted memory may lead to erratic behavior, causing the Exim daemon to crash, thereby resulting in a denial-of-service condition.\nThe vulnerability is limited to installations utilizing GnuTLS and specific non-default configurations; however, because it can be triggered over the network, it does not require prior authentication. The post-exploitation impact ranges from system compromise, where the attacker gains the privileges of the Exim process user, to the total exhaustion of mail services, affecting the reliability and security of the entire mail routing infrastructure."
}