One Newline to Own Exim: How a Tiny TLS/BDAT Use-After-Free Became Unauthenticated RCE

A deep dive into CVE-2026-45185: an unauthenticated Exim RCE where one stale TLS/BDAT ungetc() byte corrupts freed memory and leads to exploitation.