Exim "Dead.Letter" (CVE-2026-45185): Zero-Auth RCE on GnuTLS Mail Servers — Patch to 4.99.3 Now

Exim 4.99.2 and every version back to 4.97 — roughly the last three years of releases — contains an unauthenticated remote code execution vulnerability. CVE-2026-45185, nicknamed Dead.Letter, was discovered by the AI-assisted security research team at XBOW, and a working exploit was built before the public disclosure landed. Patch now.

What the bug does

Dead.Letter lives in Exim’s BDAT (binary data transmission) message-body parsing path when TLS is handled by GnuTLS. The attack sequence:

1. An attacker opens a TLS connection and begins an SMTP transaction using the CHUNKING extension (BDAT).
2. Before the body transfer completes, the attacker sends a TLS close_notify alert.
3. They then send one final byte of body data in plaintext on the same TCP connection.

Exim writes that byte into a memory buffer that was already freed during TLS session teardown — classic heap use-after-free. An attacker who controls the heap layout can turn this into arbitrary code execution running as the Exim daemon, typically root or Debian-exim depending on the distro.

CVSS score: 9.8 Critical. Zero credentials. Zero user interaction. No special server configuration required. The only prerequisite is a reachable Exim instance with GnuTLS and CHUNKING enabled — the default for most distros.

Scope

Only GnuTLS builds are affected (USE_GNUTLS=yes). Installs compiled against OpenSSL are not vulnerable. If you’re running Debian, Ubuntu, or Alpine’s packaged Exim, assume you’re using GnuTLS and therefore affected. RedHat-family distros that ship the OpenSSL-linked build are safe.

Check your build:

exim --version | grep GnuTLS

If that returns a version string, patch immediately.

Affected versions

• Exim 4.97 through 4.99.2 (GnuTLS builds only)

Fix

Upgrade to Exim 4.99.3, available on the official Exim download mirrors and most major distribution repos as of May 13. Debian and Ubuntu have pushed packages to the security channels.

# Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade exim4

# Verify
exim --version

If you cannot upgrade immediately, disabling CHUNKING via chunking_advertise_hosts = (set to empty) in exim4.conf removes the vulnerable code path. This is a temporary mitigation — it breaks CHUNKING for all senders but does not affect normal SMTP delivery.

AI-discovered, AI-exploited

XBOW’s disclosure is notable for the method: their automated vulnerability research system found the bug and generated a working proof-of-concept before any human had looked at the code path. The exploit development timeline from discovery to working PoC was measured in hours, not weeks.

This follows the Google report from last week documenting criminal use of LLMs to weaponize a 2FA zero-day. The attack surface against mail infrastructure is hardening fast on both sides of that equation.

Exim powers a significant fraction of the internet’s SMTP infrastructure — estimates place it at 20–30% of all public MX records. If you run it, treat this as a P0.