New critical Exim mailer flaw allows remote code execution

A critical use-after-free vulnerability (CVE-2026-45185) in Exim mail transfer agent versions 4.97–4.99.2 allows unauthenticated remote code execution. The flaw is triggered during TLS shutdown when handling BDAT chunked SMTP traffic on GnuTLS-based builds with STARTTLS and CHUNKING enabled. OpenSSL builds are unaffected. A patch is available in Exim 4.99.3. The discovery also highlights an AI vs. human exploit development race: XBOW's autonomous AI system produced a working exploit on simplified targets, while a human researcher aided by an LLM ultimately won on a hardened target with ASLR. The researcher noted LLMs are not yet ready to independently write exploits against real-world production software but are valuable for accelerating code comprehension.