CVE-2026-45185: 
Exim vulnerability analysis and mitigation

CVE-2026-45185, dubbed "Dead.Letter," is a critical use-after-free (UAF) vulnerability in the Exim mail transfer agent affecting versions 4.97 through 4.99.x built with GnuTLS support and configured to advertise STARTTLS and CHUNKING. The flaw resides in Exim's BDAT (binary data transmission) body parsing path and allows an unauthenticated remote attacker to achieve arbitrary code execution via heap corruption. It was discovered by xbow security and publicly disclosed on May 12, 2026, with a coordinated patch release. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, oss-security).

The vulnerability is classified as CWE-416 (Use After Free) and is triggered by a specific sequence of protocol events: a client sends a TLS close_notify alert mid-body during a CHUNKING (SMTP BDAT) transfer, followed by a final cleartext byte on the same TCP connection. This unexpected TLS teardown causes Exim's GnuTLS-backed BDAT parser to reference already-freed heap memory, leading to heap corruption that can be leveraged for code execution. The attack requires no authentication, no user interaction, and is network-accessible with low complexity, making it trivially exploitable against any exposed Exim instance meeting the configuration prerequisites (GnuTLS build with STARTTLS and CHUNKING enabled). A technical write-up was published by the discovering team at xbow security (xbow blog, oss-security).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code with the privileges of the Exim process, which typically runs as a dedicated mail user but may have elevated access to mail queues, configuration files, and system resources. This can result in full confidentiality, integrity, and availability compromise of the affected mail server, including interception or manipulation of email traffic, installation of backdoors or malware, and potential lateral movement within the network. Given Exim's widespread deployment as one of the most common MTAs on Linux systems, the blast radius is significant (GitHub Advisory, xbow blog).

As of disclosure, no confirmed in-the-wild exploitation has been reported, and the EPSS score is approximately 0.059–0.082%, placing it in the lower percentiles for near-term exploitation probability. A detection script (not a functional exploit) was published on GitHub by liamromanis101 to check whether a system is vulnerable; a separate repository (MJ-bin/POC_CVE-2026-45185) has also appeared, though no weaponized exploit has been confirmed. The vulnerability is not currently listed in the CISA KEV catalog. No specific threat actor attribution has been made (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing Exim mail servers using tools like Shodan or Censys, filtering for SMTP banners indicating Exim versions 4.97–4.99.x. Confirm GnuTLS build and CHUNKING/STARTTLS support by connecting to port 25 and issuing EHLO to inspect advertised capabilities.
2. Establish TLS connection: Initiate a standard SMTP connection to the target and upgrade to TLS via STARTTLS, establishing a GnuTLS-backed encrypted session.
3. Begin CHUNKING transfer: Send a BDAT command to initiate a CHUNKING transfer, beginning to transmit the message body over the TLS connection.
4. Send TLS close_notify mid-body: While the BDAT body transfer is in progress (before the final chunk is sent), transmit a TLS close_notify alert to signal TLS session termination, triggering the GnuTLS session teardown and freeing associated memory.
5. Send cleartext byte: Immediately after the close_notify, send a final cleartext byte on the same underlying TCP connection. This causes Exim's BDAT parser to reference the now-freed memory, triggering the use-after-free condition.
6. Achieve heap corruption and code execution: The heap corruption resulting from the UAF can be leveraged (with appropriate heap grooming) to redirect execution flow and achieve arbitrary code execution as the Exim process user (xbow blog, oss-security).

• Network: Anomalous SMTP sessions to port 25 that initiate a BDAT/CHUNKING transfer followed by an abrupt TLS close_notify mid-transfer; unexpected cleartext data following TLS session teardown on the same TCP connection; unusual outbound connections from the Exim process to external IPs.
• Logs: Exim main log (/var/log/exim4/mainlog) entries showing incomplete or malformed BDAT transactions, TLS handshake errors, or unexpected session resets mid-delivery; GnuTLS error messages or segmentation fault traces in system logs.
• Process: Unexpected child processes spawned by the Exim daemon (e.g., /bin/sh, bash, curl, wget, python) visible via ps or process auditing tools; Exim process crashes or restarts logged by the init system.
• File System: New or modified files in Exim spool directories (/var/spool/exim4/) or configuration directories; unexpected cron jobs, SSH authorized keys, or web shells created under the Exim service account's home directory.
• System: Core dump files generated by the Exim process; unusual entries in /etc/passwd or /etc/shadow if the attacker escalated privileges post-exploitation (xbow blog, oss-security).

The primary remediation is to upgrade Exim to version 4.99.3 or later, which contains the fix for this vulnerability. Fixed tarballs are available at https://downloads.exim.org/exim4/ and the patched branch is tagged exim-4.99.3 in the official repository. If immediate patching is not feasible, administrators should consider disabling CHUNKING support in Exim's configuration (removing CHUNKING from advertised capabilities) or restricting STARTTLS to trusted sources via network-level controls. Distribution-specific packages (Debian, Ubuntu, etc.) have been updated and should be applied via the standard package manager. Qualys detection plugins (IDs 6276500 and 6035800) are available for vulnerability scanning (oss-security, cPanel Advisory).

The vulnerability generated significant community attention upon disclosure, trending on Hacker News (multiple threads including item IDs 48111748 and 48112876) and discussed across Reddit communities including r/netsec, r/linuxadmin, and r/cybersecurity. Security outlets including BleepingComputer, The Hacker News, Cyber Express, and GBHackers published coverage within hours of disclosure. The xbow security team, which discovered the vulnerability using AI-assisted offensive security tooling, published a detailed technical write-up and noted the finding as a demonstration of autonomous vulnerability discovery. The Exim maintainer Heiko Schlittermann acknowledged and thanked xbow security in the official oss-security disclosure. The Irish NCSC (NCSC.gov.ie) also published an advisory, reflecting broad governmental awareness (xbow blog, oss-security, BleepingComputer).