internet-facing-service-vulnerabilitywidely-deployed-product-advisoryproof-of-concept-release

Exim fixes critical BDAT use-after-free that could enable remote code execution

Vulnerability Disclosure · 13 sources · Updated 4mo ago · First seen May 12, 2026

Exim maintainers released Exim 4.99.3 to fix a critical remotely reachable use-after-free flaw in the SMTP server’s BDAT body parsing path, tracked as CVE-2026-45185 and referred to as Dead.Letter. The vulnerability affects Exim 4.97 through 4.99.2/4.99.x when built with GnuTLS support and configured to advertise both STARTTLS and CHUNKING, and successful exploitation can cause heap corruption with potential remote code execution. Maintainers said Linux distributions received coordinated access to patches ahead of disclosure and urged users to upgrade immediately.

According to the advisory and follow-on reporting, the bug is triggered when a client sends a TLS close_notify before a BDAT transfer finishes and then sends a final cleartext byte over the same TCP connection, leaving Exim in an unsafe state. Exim said there are no effective mitigations short of upgrading, and fixed the issue in 4.99.3 by resetting the input-processing stack when TLS shutdown occurs during an active BDAT transfer. The flaw was reported by Federico Kirschbaum of XBOW security, with fuller technical details to be published under EXIM-Security-2026-05-01.1.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

6 events · May 1, 2026 – May 12, 2026

May 12, 20266mo ago
Technical exploitation details for CVE-2026-45185 are revealed
By May 12, 2026, public reporting described the trigger condition for the flaw: a client can send a TLS close_notify before BDAT transfer completion and then send a final cleartext byte on the same TCP connection. This clarified how the vulnerability could lead to heap corruption and possible remote code execution on affected GnuTLS-based Exim deployments.
May 11, 20266mo ago
Google reports first AI-assisted in-the-wild zero-day exploit
On 2026-05-11, Google Threat Intelligence Group reportedly described the first documented in-the-wild zero-day exploit built with material AI assistance. The report said the Python-based 2FA bypass targeted a widely deployed open-source administration tool and had been patched with the vendor before the campaign launched.
The Machine Found It First. The Machine Will Exploit It Next. | Hive Pro
May 10, 20266mo ago
CVE-2026-45185 assigned to Exim Dead.Letter vulnerability
The Exim BDAT use-after-free flaw reported by XBOW was assigned identifier CVE-2026-45185. XBOW's published disclosure timeline places the CVE assignment on May 10, 2026, ahead of the public technical release.
XBOW - Dead.Letter (CVE-2026-45185) How XBOW Found an Unauthenticated RCE on Exim
May 1, 20266mo ago
Exim publishes advisory urging immediate upgrades
Exim publicly disclosed advisory EXIM-Security-2026-05-01.1 and warned that there are no mitigations short of upgrading to 4.99.3 or later. The maintainers also noted that Linux distributions had already received coordinated access to patches and that fuller technical details would be published separately.
May 1, 20266mo ago
Exim releases version 4.99.3 to fix Dead.Letter flaw
On May 1, 2026, Exim maintainers released security update 4.99.3 to fix CVE-2026-45185, also called Dead.Letter. The patch resets the input processing stack when TLS shutdown occurs during an active BDAT transfer, preventing heap corruption and potential code execution.
May 1, 20266mo ago
XBOW reports Exim BDAT use-after-free vulnerability
Federico Kirschbaum of XBOW discovered and reported a critical remotely reachable use-after-free flaw in Exim's BDAT body parsing path. The issue affects Exim 4.97 through 4.99.2/4.99.x when built with GnuTLS support and advertising both STARTTLS and CHUNKING.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Dead.Letter (CVE-2026-45185)

Affected products

1 linked

Exim

Organizations

1 linked

Exim

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

13 references tracked. Mallory keeps watching after this page renders.

HiveproNews · May 15, 2026

The Machine Found It First. The Machine Will Exploit It Next. | Hive ProOpen source ↗

Cpanel Product AdvisoriesNews · May 15, 2026

Security: CVE-2026-45185 (Dead.Letter) - cPanelOpen source ↗

ScworldNews · May 14, 2026

Critical Exim vulnerability allows remote code execution | brief | SC MediaOpen source ↗

Thecyberexpress Com VulnerabilitiesNews · May 14, 2026

Exim BDAT Vulnerability Patch Released For CVE-2026Open source ↗

5 additional sources from 01-05-2026 to 13-05-2026

OpennetNews · May 1, 2026

�� Exim, �� ̣�� Open source ↗

OpenwallNews · May 1, 2026

oss-security - [EXIM-Security-2026-05-01.1] Security Release 4.99.3Open source ↗

Oss Security Mailing ListNews · May 1, 2026

oss-sec: Re: [EXIM-Security-2026-05-01.1] Security Release 4.99.3Open source ↗

Xbow BlogNews · Jan 5, 2026

XBOW - Dead.Letter (CVE-2026-45185) How XBOW Found an Unauthenticated RCE on EximOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

internet-facing-service-vulnerabilitywidely-deployed-product-advisoryproof-of-concept-release

Exim fixes critical BDAT use-after-free that could enable remote code execution

Vulnerability Disclosure · 13 sources · Updated 4mo ago · First seen May 12, 2026

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

6 events · May 1, 2026 – May 12, 2026

May 12, 20266mo ago
Technical exploitation details for CVE-2026-45185 are revealed
By May 12, 2026, public reporting described the trigger condition for the flaw: a client can send a TLS close_notify before BDAT transfer completion and then send a final cleartext byte on the same TCP connection. This clarified how the vulnerability could lead to heap corruption and possible remote code execution on affected GnuTLS-based Exim deployments.
May 11, 20266mo ago
Google reports first AI-assisted in-the-wild zero-day exploit
On 2026-05-11, Google Threat Intelligence Group reportedly described the first documented in-the-wild zero-day exploit built with material AI assistance. The report said the Python-based 2FA bypass targeted a widely deployed open-source administration tool and had been patched with the vendor before the campaign launched.
The Machine Found It First. The Machine Will Exploit It Next. | Hive Pro
May 10, 20266mo ago
CVE-2026-45185 assigned to Exim Dead.Letter vulnerability
The Exim BDAT use-after-free flaw reported by XBOW was assigned identifier CVE-2026-45185. XBOW's published disclosure timeline places the CVE assignment on May 10, 2026, ahead of the public technical release.
XBOW - Dead.Letter (CVE-2026-45185) How XBOW Found an Unauthenticated RCE on Exim
May 1, 20266mo ago
Exim publishes advisory urging immediate upgrades
Exim publicly disclosed advisory EXIM-Security-2026-05-01.1 and warned that there are no mitigations short of upgrading to 4.99.3 or later. The maintainers also noted that Linux distributions had already received coordinated access to patches and that fuller technical details would be published separately.
May 1, 20266mo ago
Exim releases version 4.99.3 to fix Dead.Letter flaw
On May 1, 2026, Exim maintainers released security update 4.99.3 to fix CVE-2026-45185, also called Dead.Letter. The patch resets the input processing stack when TLS shutdown occurs during an active BDAT transfer, preventing heap corruption and potential code execution.
May 1, 20266mo ago
XBOW reports Exim BDAT use-after-free vulnerability
Federico Kirschbaum of XBOW discovered and reported a critical remotely reachable use-after-free flaw in Exim's BDAT body parsing path. The issue affects Exim 4.97 through 4.99.2/4.99.x when built with GnuTLS support and advertising both STARTTLS and CHUNKING.

Linked entities