Key takeaway: CVE-2026-45185 — a use-after-free vulnerability in Exim's BDAT (binary data transmission) message body parsing — allows unauthenticated remote code execution on one of the world's most widely deployed mail transfer agents. Affects Exim versions 4.97 through 4.99.2 when built with GnuTLS. Patch to 4.99.3 immediately.
What Happened
On May 12, 2026, the Exim development team released version 4.99.3 to address CVE-2026-45185, a use-after-free vulnerability in the BDAT message body parsing path. The flaw, nicknamed "Dead.Letter," affects all Exim builds using the GnuTLS library for TLS connections — which is the default on most Linux distributions. The vulnerability can be triggered by a remote, unauthenticated attacker sending a specially crafted email.
Exim is the default MTA on Debian, Ubuntu, and numerous other Linux distributions. It's estimated to handle a significant portion of the world's email traffic. The vulnerability was discovered by the XBOW research team, who notably used AI assistance to help develop the working exploit — making this the second confirmed case of AI-assisted zero-day development in the same week.
Technical Analysis
