Exim has patched CVE-2026-45185, also known as Dead.Letter, a severe use-after-free flaw in BDAT message handling that could lead to heap corruption and potential code execution on affected GnuTLS-based builds. The issue impacts Exim versions 4.97 through 4.99.2 and is fixed in 4.99.3, with users urged to upgrade immediately. #Exim #CVE-2026-45185 #Dead.Letter #GnuTLS #XBOW #FedericoKirschbaum
Keypoints
- Exim released security updates for a severe use-after-free vulnerability.
- CVE-2026-45185 affects BDAT processing when Exim uses GnuTLS.
- An attacker can trigger heap corruption by interrupting TLS transfer with close_notify.
- The flaw impacts Exim versions 4.97 through 4.99.2 with USE_GNUTLS=yes.
- Version 4.99.3 fixes the issue, and no mitigations are available.
Read More: https://thehackernews.com/2026/05/new-exim-bdat-vulnerability-exposes.html