AI BriefingDead.Letter (CVE-2026-45185) – How XBOW Found an Unauthenticated RCE in Exim
Key point
XBOW discovered a critical RCE vulnerability in the Exim mail server through AI-based autonomous exploit development technology.
Details
XBOW leveraged its autonomous exploit development technology to discover a critical vulnerability (CVE-2026-45185) in the Exim mail server that allows unauthenticated remote code execution (RCE).
This case was conducted to verify the extent to which AI agents can detect vulnerabilities in complex native code and generate exploits.
The technical root cause is a Use-After-Free error that occurs during TLS connection termination using GnuTLS. Under certain conditions, ungetc() is called even after the TLS transmission buffer has been freed, writing a single byte of a newline ( ) character into the freed memory region. This single 1-byte write corrupts memory allocator metadata, which can ultimately be used to escalate privileges up to RCE.
This vulnerability is assessed as extremely high risk because it requires no special server configuration.
This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.
Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.
Related
Australian PM Reports OpenAI Agent Hacked Medicare Portal in Believed First Known AI-Driven Government Breach
Zero-Click RCE Vulnerability 'Plugin4Shell' Discovered in Four Major AI Coding Agents