Exim has released security updates to address a serious security issue that affects some BDAT configurations and could allow memory corruption and possible code execution.
See also: Claude Mythos finds only one vulnerability in Curl – what is it?
The vulnerability, tracked as CVE-2026-45185 and known as Dead.Letter, has been described as a use-after-free vulnerability in Exim's BDAT message body parsing when a TLS connection is managed by GnuTLS.
The vulnerability is triggered during the handling of the BDAT message body when a client sends a close_notify TLS before the body transfer is complete and then follows with a cleartext final byte on the same TCP connection. This sequence of events can cause Exim to write to a buffer that has already been freed during the TLS session disconnect, leading to heap corruption.
An attacker only needs to be able to establish a TLS connection and use the CHUNKING (BDAT) SMTP.
The issue affects all versions of Exim from 4.97 through 4.99.2. However, it only affects builds that use USE_GNUTLS=yes, meaning that builds that rely on other TLS libraries such as OpenSSL are not affected.
See also: SAP fixes vulnerabilities in Commerce Cloud and S/4HANA
Federico Kirschbaum, head of the Security Lab at XBOW, an autonomous cybersecurity testing platform, discovered and reported the bug on May 1, 2026. During TLS disconnect, Exim frees the TLS transport buffer, but an embedded BDAT can still process incoming bytes and end up calling the ungetc(), which writes a single character (\n) to the freed area.
This single-byte write lands in Exim's allocator metadata, corrupting the allocator. The exploit then leverages this corruption to obtain further primitives.
XBOW described the vulnerability as “one of the highest quality bugs” discovered in Exim to date, adding that enabling it requires almost no special configuration on the server.
The issue has been addressed in version 4.99.3. All users are advised to upgrade as soon as possible. There are no mitigations that address the vulnerability. The fix ensures that the input processing stack is reset cleanly when a TLS close notification is received during an active BDAT transfer, preventing the use of old pointers.
See also: Apple fixes serious security vulnerabilities
This is not the first time that critical post-release exploits have been discovered in Exim. In late 2017, Exim patched a post-release exploit in the SMTP daemon (CVE-2017-16943, CVSS score: 9.8) that unauthenticated attackers could exploit to achieve remote code execution via specially crafted BDAT commands and take control of the email server.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
