Critical Use-After-Free Vulnerability Patched in Exim Mail Server (advisories.ncsc.nl)

• Use-after-free vulnerability in Exim prior to 4.99.3 (BDAT parsing with GnuTLS)
• Remote exploitation by unauthenticated attacker leading to heap corruption
• Exploitable only with specific GnuTLS backend configurations
• Immediate upgrade to Exim 4.99.3 recommended

"Exim developers have fixed a use-after-free vulnerability in versions before 4.99.3. The flaw exists in the BDAT body parsing path, exploitable only with certain GnuTLS backend configurations. An unauthenticated remote attacker can trigger heap corruption, potentially leading to arbitrary code execution. All Exim installations running older versions with affected GnuTLS setups are at risk."