Exim before 4.99.3 contains a remotely reachable use‑after‑free flaw in the BDAT body parsing path. When a client sends a TLS close_notify mid‑body during a CHUNKING transfer and follows it with a cleartext byte on the same TCP connection, the parser can access freed memory, causing heap corruption. An attacker can exploit this corruption to execute arbitrary code on the host running Exim, potentially with the permissions of the Exim process.

The vulnerability affects the Exim mail transfer agent, including all versions prior to 4.99.3. No specific sub‑versions or third‑party libraries are listed beyond the generic GnuTLS configuration requirement.

The EPSS score of 1% indicates that the likelihood of exploitation is low but nonzero. The vulnerability is not listed in the CISA KEV catalog. The bug’s nature – a use‑after‑free leading to arbitrary code execution – results in a CVSS score of 9.8, reflecting extreme severity. This high score indicates a high likelihood of exploitation by an unauthenticated network attacker able to send crafted TLS frames to the Exim service. The attack vector requires network access only; no local or authenticated privilege escalation steps are needed, making the risk significant for exposed mail servers.