# Critical Exim "Dead.Letter" Use-After-Free Flaw Enables Remote Code Execution in GnuTLS Deployments
## The Threat
Exim, the widely-used open-source Mail Transfer Agent (MTA) powering email infrastructure across thousands of organizations, has released urgent patches for a severe use-after-free vulnerability that could allow attackers to corrupt heap memory and achieve remote code execution. Tracked as CVE-2026-45185 and nicknamed "Dead.Letter," the flaw specifically targets configurations that use GnuTLS for TLS encryption—a deliberate choice many organizations make to avoid OpenSSL dependencies.
The vulnerability exists in Exim's handling of BDAT (binary data transmission) SMTP commands during TLS session teardown. When a client sends a TLS close_notify alert before completing a chunked message body transfer, then follows up with a final byte in cleartext on the same TCP connection, Exim's input processing stack fails to properly reset. This leaves freed memory accessible to subsequent operations, allowing a single-byte write to corrupt the heap allocator's internal metadata. Security researcher Federico Kirschbaum of XBOW described the exploitation chain as "one of the highest-caliber bugs" discovered in Exim, requiring minimal attacker capabilities and almost no special server configuration.
The attack is particularly insidious because it requires only the ability to establish an authenticated or unauthenticated TLS connection and support for the CHUNKING SMTP extension—features enabled by default on standard Exim deployments. No complex social engineering, credential theft, or prior system access is necessary. Once the heap allocator is corrupted, attackers can leverage that corruption to gain further memory manipulation primitives, ultimately leading to code execution within the Exim process.
## Severity and Impact
| Field | Value |
|-------|-------|
| CVE ID | CVE-2026-45185 ("Dead.Letter") |
| Vulnerability Type | Use-after-free / Heap Corruption |
| CVSS v3.1 Score | 9.8 (Critical) |
| CVSS Vector | CVSS:3.1/AV:N/AU:N/AC:L/C:H/I:H/A:H |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality Impact | High |
| Integrity Impact | High |
| Availability Impact | High |
| CWE | CWE-416 (Use After Free) |
| Public Disclosure | May 12, 2026 |
| Discoverer | Federico Kirschbaum, XBOW Security Lab |
## Affected Products
The vulnerability impacts all Exim versions from 4.97 through 4.99.2, but only when compiled with USE_GNUTLS=yes:
Notably unaffected: Exim builds using OpenSSL, LibreSSL, or other TLS libraries are not vulnerable. The flaw is isolated to GnuTLS-based implementations.
Fixed: Exim version 4.99.3 and later (upgrade required).
## Mitigations
No workarounds exist that fully resolve this vulnerability. Exim's developers explicitly state that input processing stack management during TLS session teardown must be patched at the code level.
Immediate actions required:
1. Upgrade immediately — Deploy Exim 4.99.3 or later on all affected systems. This is a critical patch that should be prioritized above standard maintenance windows.
2. Verify GnuTLS usage — Confirm whether your Exim deployment uses GnuTLS by running:
```
exim -bV | grep -i gnutls
```
If output shows GnuTLS is compiled in, you are affected and must upgrade.
3. Monitor for exploitation — Review SMTP logs dating back to May 1, 2026 (discovery date) for unusual BDAT sequences, TLS close_notify alerts followed by cleartext bytes, or unexpected process crashes. Use a SIEM or log aggregation tool to flag anomalies.
4. Implement network segmentation — Restrict SMTP access to Exim servers using firewalls or network ACLs. Limit inbound SMTP connections to trusted relay partners when possible.
5. Monitor process behavior — On GnuTLS-based deployments not yet patched, enable robust process monitoring and alerting for Exim crashes, unexpected restarts, or privilege escalation attempts.
6. Consider temporary OpenSSL builds — If an emergency prevents immediate Exim 4.99.3 deployment, consider recompiling Exim with OpenSSL instead of GnuTLS as a temporary measure until the patch can be applied.
## References
---
## HackWire Analysis
The "Dead.Letter" vulnerability represents a watershed moment in Exim's security posture. While Exim has weathered critical bugs before—including a nearly identical use-after-free flaw in the SMTP daemon in 2017 (CVE-2017-16943, CVSS 9.8)—the discovery that a nearly identical attack class exists nine years later, in different code paths and affecting different TLS libraries, suggests systemic gaps in memory safety practices across the codebase.
What makes this disclosure particularly relevant now: the shift toward GnuTLS adoption. Organizations prioritizing supply-chain security and dependency minimization have deliberately chosen GnuTLS over OpenSSL to avoid the sprawling, historically-buggy OpenSSL codebase. Those defensive choices are now a liability. It's a reminder that choosing one library over another doesn't eliminate the risk surface—it redistributes it. GnuTLS was the safer choice for some threat models; it became the only vulnerable choice for this particular bug.
The XBOW team's characterization of the exploit as requiring "almost no special configuration" is the key risk indicator here. This isn't a bug that requires a custom SMTP configuration, a non-standard build option, or social engineering. A remote attacker can trigger it against a stock Exim instance running on default settings with only a TLS socket and CHUNKING support—both standard. That's critical infrastructure exposure at scale.
For defenders: this is an urgent patch Tuesday, not a "evaluate and test" scenario. For Exim operators in regulated industries (financial, healthcare, government), delay beyond this week creates compliance liability. For vendors offering managed email services or relaying, verification of patch deployment should be part of your incident response playbook *this week*.
The broader lesson: use-after-free bugs persist in mature C codebases because they're phenomenally difficult to catch without fuzzing or formal verification. Exim's developers are competent; the bug is just hard. Organizations with critical email infrastructure should consider whether Exim's memory-safety posture meets risk appetite, or whether languages like Go, Rust, or Python-based alternatives warrant evaluation for new deployments.
— HackWire Editorial
---
## Related Coverage