Re: [exim/exim] CVE-2026-45185 seems to be unexploitable. (Issue #3225)

Based on our hundreds of rounds of dynamic instrumentation verification, the fundamental reason for the unreachability of tls_ungetc is the cleanup logic of tls_close() itself - it is not an environmental issue, nor is it purely "unreachable in itself", but rather tls_close() has restored receive_ungetc to smtp_ungetc before releasing the xfer_buffer.
This means that even if all the prerequisite conditions are met (clean TLS EOF, BDAT LAST, line length == -1), the EOD repair path calls smtp_ungetc, and the written target is a secure plaintext buffer, not the released ssl_xfer_buffer.
The UAF write path described in the vulnerability report is blocked by the recovery mechanism of tls_close() in the source code logic. It is unlikely to be an accidental failure caused by the environment. We hope the exim team can provide a response: Is this vulnerability not exploitable at all? And the claim made by other researchers that "uaf -> rce" is purely an exaggeration is also unfounded.

---
View it on Exim Forgejo ( https://code.exim.org/exim/exim/issues/3225#issuecomment-239630 ) or reply to this email directly.