- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,494
The analysis of the vulnerability has turned into a rare experiment about the future of bugs.
Postal servers rarely become heroes of dramatic stories, but the fresh analysis of XBOW turned out exactly this. The team found a critical vulnerability in Exim, one of the most common mail servers, and then turned a week before public disclosure into an unusual experiment: people and an autonomous AI system were trying to understand how realistic it was to bring the error to remote code execution.
The vulnerability was received by the identifier CVE-2026-45185. According to the authors of the report, the problem affects the processing of TLS connections through GunTLS, which by default is used in many Debian distributions, including Ubuntu. The error occurs when the TLS session is completed: Exim releases the transmission buffer, but the nested BDAT handler can still receive data and cause ungetc(). As a result, one byte is recorded in an already liberated area of memory.
At first glance, such a record looks weak: the memory gets the whole symbol of the line (0x0a) or the return of the carriage (0x0d). But for Exim even had one byte. Due to the peculiarities of the internal allocator of the mail server, the damage could lead to further control of the memory and, ultimately, to the remote execution of the code without authentication. The authors emphasize that to trigger an error, you almost do not need a special configuration of the server, which dramatically increases the danger of the problem.
XBOW announced the discovery of Exim developers on May 1 of this year. Already on May 5, the project team confirmed the existence of a correction in a closed repository, on May 8, they notified the distributions, on May 10, accompanying packages received access to the data, and on May 12, an agreed publication of information about the vulnerability took place.
A separate part of the story is related to AI. XBOW Native was able to build workflows for simplified conditions, first without ASLR and PIE, then with ASLR, but without PIE. In one embodiment, the system used techniques specific to CTF tasks, including an attack on glibc structures and FILE substitution. In the second case, the approach was closer to the real story of Exim: AI attacked the internal allocator of the server and achieved the execution of the command through the ACL mechanism.
For the full production assembly, the result was more modest. The author of the human part of the experiment with the help of a language model achieved a leak of the stack address, but it did not come to a full-fledged exploit. XBOW Native under the same conditions did not even receive leaks.
The result was ambiguous: AI is already accelerating the analysis of complex code and helps to find non-standard ways, but self-explore of real goals still requires human control, testing hypotheses and a deep understanding of the task.
Postal servers rarely become heroes of dramatic stories, but the fresh analysis of XBOW turned out exactly this. The team found a critical vulnerability in Exim, one of the most common mail servers, and then turned a week before public disclosure into an unusual experiment: people and an autonomous AI system were trying to understand how realistic it was to bring the error to remote code execution.
The vulnerability was received by the identifier CVE-2026-45185. According to the authors of the report, the problem affects the processing of TLS connections through GunTLS, which by default is used in many Debian distributions, including Ubuntu. The error occurs when the TLS session is completed: Exim releases the transmission buffer, but the nested BDAT handler can still receive data and cause ungetc(). As a result, one byte is recorded in an already liberated area of memory.
At first glance, such a record looks weak: the memory gets the whole symbol of the line (0x0a) or the return of the carriage (0x0d). But for Exim even had one byte. Due to the peculiarities of the internal allocator of the mail server, the damage could lead to further control of the memory and, ultimately, to the remote execution of the code without authentication. The authors emphasize that to trigger an error, you almost do not need a special configuration of the server, which dramatically increases the danger of the problem.
XBOW announced the discovery of Exim developers on May 1 of this year. Already on May 5, the project team confirmed the existence of a correction in a closed repository, on May 8, they notified the distributions, on May 10, accompanying packages received access to the data, and on May 12, an agreed publication of information about the vulnerability took place.
A separate part of the story is related to AI. XBOW Native was able to build workflows for simplified conditions, first without ASLR and PIE, then with ASLR, but without PIE. In one embodiment, the system used techniques specific to CTF tasks, including an attack on glibc structures and FILE substitution. In the second case, the approach was closer to the real story of Exim: AI attacked the internal allocator of the server and achieved the execution of the command through the ACL mechanism.
For the full production assembly, the result was more modest. The author of the human part of the experiment with the help of a language model achieved a leak of the stack address, but it did not come to a full-fledged exploit. XBOW Native under the same conditions did not even receive leaks.
The result was ambiguous: AI is already accelerating the analysis of complex code and helps to find non-standard ways, but self-explore of real goals still requires human control, testing hypotheses and a deep understanding of the task.
