Reported by 2 outlets

Timeline

1. original reporting

   Exim "Dead.Letter" — unauthenticated RCE in internet-facing mail servers (CVE-2026-45185) [TLDR InfoSec]

   blog.gridinsoft.com · 154d ago · May 13th, 2026

   XBOW security researchers have disclosed CVE-2026-45185, an unauthenticated use-after-free in Exim's BDAT body parsing path when built with GnuTLS. During TLS shutdown, a nested BDAT receive wrapper can still process bytes and write a newline into freed memory, providing a path from small heap corruption to code execution. Affects Exim 4.97–4.99.2 with STARTTLS and CHUNKING enabled. XBOW describes it as "one of the highest-caliber bugs" found in Exim. Fixed in version 4.99.3. Exim runs approximately 50-60% of the internet's mail servers — administrators should patch immediately and review logs for unusual STARTTLS/BDAT session patterns, crashes, or paniclog entries.

2. update from cyberpress.org

   Exim Dead.Letter CVE-2026-45185 — Unauthenticated RCE, Detailed Exploitation Available

   cyberpress.org · 152d ago · May 15th, 2026

   New analysis confirms CVE-2026-45185 ("Dead.Letter"), a use-after-free in Exim versions 4.97–4.99.2 compiled with GnuTLS, can be reliably escalated from a one-byte heap write to full remote code execution. The flaw triggers when a malicious client sends a TLS close_notify during an active BDAT session, causing Exim to free a buffer while stale callback pointers remain active. Exploitation requires no authentication and no special configuration beyond the vulnerable GnuTLS + BDAT combination. OpenSSL-based builds are not affected. Exim 4.99.3 patches the issue. Researchers note LLM-assisted exploit generation is accelerating the disclosure-to-weaponization timeline.