Loading story…
Exim maintainers released Exim 4.99.3 to fix a critical remotely reachable use-after-free flaw in the SMTP server’s BDAT body parsing path, tracked as CVE-2026-45185 and referred to as Dead.Letter. The vulnerability affects Exim 4.97 through 4.99.2/4.99.x when built with GnuTLS support and configured to advertise both STARTTLS and CHUNKING, and successful exploitation can cause heap corruption with potential remote code execution. Maintainers said Linux distributions received coordinated access to patches ahead of disclosure and urged users to upgrade immediately.
According to the advisory and follow-on reporting, the bug is triggered when a client sends a TLS close_notify before a BDAT transfer finishes and then sends a final cleartext byte over the same TCP connection, leaving Exim in an unsafe state. Exim said there are no effective mitigations short of upgrading, and fixed the issue in 4.99.3 by resetting the input-processing stack when TLS shutdown occurs during an active BDAT transfer. The flaw was reported by Federico Kirschbaum of XBOW security, with fuller technical details to be published under EXIM-Security-2026-05-01.1.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
By May 12, 2026, public reporting described the trigger condition for the flaw: a client can send a TLS close_notify before BDAT transfer completion and then send a final cleartext byte on the same TCP connection. This clarified how the vulnerability could lead to heap corruption and possible remote code execution on affected GnuTLS-based Exim deployments.
On 2026-05-11, Google Threat Intelligence Group reportedly described the first documented in-the-wild zero-day exploit built with material AI assistance. The report said the Python-based 2FA bypass targeted a widely deployed open-source administration tool and had been patched with the vendor before the campaign launched.
The Exim BDAT use-after-free flaw reported by XBOW was assigned identifier CVE-2026-45185. XBOW's published disclosure timeline places the CVE assignment on May 10, 2026, ahead of the public technical release.
Exim publicly disclosed advisory EXIM-Security-2026-05-01.1 and warned that there are no mitigations short of upgrading to 4.99.3 or later. The maintainers also noted that Linux distributions had already received coordinated access to patches and that fuller technical details would be published separately.
On May 1, 2026, Exim maintainers released security update 4.99.3 to fix CVE-2026-45185, also called Dead.Letter. The patch resets the input processing stack when TLS shutdown occurs during an active BDAT transfer, preventing heap corruption and potential code execution.
Federico Kirschbaum of XBOW discovered and reported a critical remotely reachable use-after-free flaw in Exim's BDAT body parsing path. The issue affects Exim 4.97 through 4.99.2/4.99.x when built with GnuTLS support and advertising both STARTTLS and CHUNKING.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
13 references tracked. Mallory keeps watching after this page renders.
hivepro.com
Open sourcesupport.cpanel.net
Open sourcescworld.com
Open sourcethecyberexpress.com
Open sourceopennet.me
Open sourceopenwall.com
Open sourceseclists.org
Open sourcexbow.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Exim has released **version 4.99.2** as a security update to fix four vulnerabilities in the mail transfer agent, tracked as `CVE-2026-40684`, `CVE-2026-40685`, `CVE-2026-40686`, and `CVE-2026-40687`. The flaws affect specific configurations and stem from unsafe handling of DNS PTR data, corrupt JSON in headers, malformed UTF-8 in headers, and the SPA authenticator when interacting with a hostile or compromised external SPA/NTLM service. Reported impacts include crashes, heap corruption, out-of-bounds reads and writes, and possible heap data leakage, with older Exim branches potentially affected but no longer actively maintained. One of the disclosed issues, `CVE-2026-40684`, can crash an Exim connection on systems using **musl libc** when malformed DNS PTR record data is processed; the same behavior was not reported on glibc systems. Exim said the bug is linked to an octal-printing oddity in musl libc and noted that the issue was raised with the musl maintainer. The fixes were published through Exim's security advisory process and made available in source tarballs and the project's Git repository under the `exim-4.99.2` tag.
Jun 29, 2026
Exim maintainers released **Exim 4.99.5** to fix two local privilege-escalation vulnerabilities affecting multiple prior versions of the mail transfer agent. According to the security advisory, `EXIM-Security-2026-06-22.1` is a local directory traversal issue affecting Exim **4.88 through 4.99.4** that can let a local user access files outside the spool directory through queue-name transfer command-line arguments, while `EXIM-Security-2026-06-22.3` is a command-execution flaw affecting **4.82 through 4.99.4** in certain `.forward` and pipe transport configurations. The project said there is **no mitigation** for the directory traversal bug short of upgrading, and that the command-execution issue can be reduced by avoiding `force_command` on pipe transports. Release listings and distribution archives show the patched version has been published through Exim's official release channels, and administrators are being urged to update to **4.99.5** to prevent local file access and privilege-escalation risks on affected systems.
Jul 25, 2026
Multiple flaws in the Exim mail transfer agent include **CVE-2023-42115**, a critical unauthenticated remote-code-execution vulnerability rated CVSS 9.8. The out-of-bounds write affects Exim's SMTP service when the `EXTERNAL` authentication scheme is configured and available, potentially enabling an unauthenticated remote attacker to execute code as the Exim service account. Exim versions **4.96.1** and **4.97** address CVE-2023-42115 and the related CVE-2023-42114 and CVE-2023-42116 vulnerabilities. Organizations should upgrade promptly; where immediate patching is not possible, they should disable exposed authentication features and limit remote SMTP access. Other disclosed issues depend on configurations such as SPA/NTLM authentication, an untrusted Proxy Protocol proxy, SPF ACL use, or reliance on an untrusted DNS resolver.
Sep 3, 2026