Exim patched a critical use-after-free vulnerability (CVE-2026-45185) in its GnuTLS implementation that allows unauthenticated remote attackers to execute arbitrary code via specially crafted BDAT SMTP traffic.
XBOW discovered CVE-2026-45185, a critical unauthenticated RCE in Exim, and used the disclosure window to test how far human and autonomous exploit development could go.
