Dead.Letter — CVE-2026-45185 Unauthenticated Pre-Auth RCE in Exim via Use-After-Free in BDAT/GnuTLS

Dead.Letter — CVE-2026-45185 Unauthenticated Pre-Auth RCE in (TL-2026-0513), also tracked as Dead.Letter, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-05-13. It has no confirmed attribution, affects Exim Exim MTA, references 1 CVE (CVE-2026-45185), maps to 31 MITRE ATT&CK techniques (T1003, T1005, T1018), and is covered by 9 detection rules and 24 indicators of compromise.

Key facts for TL-2026-0513

Threat ID
TL-2026-0513
Also known as
Dead.Letter, Exim BDAT UAF, GnuTLS BDAT Close-Notify UAF
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
MONITORING
Category
VULNERABILITY
First published
2026-05-13
Last reviewed
2026-05-13
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
telecommunications, government, financial, healthcare, education, hosting-providers, managed-service-providers, technology, media, non-profit, research
Target regions
Global, North America, Europe, Asia-Pacific, Latin America, Africa
Detection rules
9
Indicators of compromise
24

Malware and tooling in Dead.Letter — CVE-2026-45185 Unauthenticated Pre-Auth RCE in

Malware and tooling: XBOW Mythos exploitation toolkit (dead-letter)

CVE-2026-45185 ("Dead.Letter") is a critical unauthenticated pre-auth remote code execution vulnerability in the Exim MTA. A use-after-free is triggered when a client sends a TLS close_notify alert during an active BDAT (CHUNKING) transfer and then transmits a final cleartext byte on the same TCP connection. Exim's nested BDAT receive wrapper calls ungetc() into a buffer (state->xfer_buffer) already freed during TLS shutdown, corrupting glibc allocator metadata and seeding heap-shaping primitives that XBOW researchers used to achieve full RCE against an ASLR-enabled target. The bug affects Exim 4.97 through 4.99.2 built with USE_GNUTLS=yes — the default on Debian, Ubuntu, and Debian-derived distributions. OpenSSL-linked builds (typical on RHEL/SUSE) are not vulnerable. Fixed in Exim 4.99.3 on 2026-05-12.

How Dead.Letter — CVE-2026-45185 Unauthenticated Pre-Auth RCE in works

Dead.Letter (CVE-2026-45185) is a pre-authentication remote code execution flaw in Exim — the most widely deployed Internet MTA and the default mail server on Debian and Ubuntu. The vulnerability is rooted in an unsafe interaction between Exim's BDAT/CHUNKING receive path and GnuTLS shutdown handling: under a precisely-shaped TCP/TLS sequence, Exim's nested BDAT receive wrapper retains a stale pointer to a TLS transfer buffer (state->xfer_buffer) that has already been freed by the GnuTLS teardown path, then performs an ungetc() that writes a single byte (newline, 0x0A) into the freed allocation. The freed slot lies in glibc's tcache/fastbin range and the write reliably lands on allocator metadata, providing the foothold required for subsequent heap-shaping primitives. The bug class is a classic use-after-free (CWE-416) compounded by an out-of-bounds write into reclaimed heap (CWE-787).

The exploit primitive is reached entirely pre-authentication. An attacker opens a TCP connection to TCP/25, TCP/465, or TCP/587, negotiates STARTTLS, issues MAIL FROM/RCPT TO followed by BDAT <N> to begin a chunked transfer, then sends a TLS close_notify alert mid-transfer and follows up with one cleartext byte on the same socket. STARTTLS and CHUNKING are both advertised by default on internet-facing Exim deployments, so no non-default configuration is required for exposure. Telemetry observed during pre-disclosure scanning suggests several hundred thousand internet-reachable Exim instances meet the trigger preconditions.

Following the initial UAF write, the XBOW exploit chain pivots through three stages: (1) heap grooming via repeated MAIL FROM and BDAT command issuance to shape tcache freelists into a desired allocator state; (2) arbitrary-read primitive constructed from a corrupted message header pointer to defeat ASLR and locate libc/the Exim text segment; (3) GOT-style overwrite of a function pointer in Exim's exec-resolver path to redirect control flow into an attacker-controlled ROP chain, ultimately calling system() with an attacker-controlled string. The XBOW disclosure includes a working ASLR-bypass exploit; the underlying primitive is also addressable from rop-chain-only and write-what-where-only paths, so additional public exploits should be expected rapidly.

Exim runs as the unprivileged "Debian-exim"/"exim" user on modern Debian and Ubuntu, but the binary frequently has access to a delivery agent setuid helper (exim4 in /usr/sbin) and writes to /var/spool/exim4 and /var/log/exim4. Local privilege escalation paths from the exim user are well-documented historically (CVE-2019-10149 and family). Post-exploitation we expect adversaries to: (a) install persistence via exim's filter or routers configuration; (b) use the compromised MTA as a high-trust pivot for outbound phishing, since the host frequently has unrestricted egress on TCP/25 and high reputation; (c) read in-transit messages from /var/spool/exim4 for credential and password-reset interception; (d) move laterally via SSH/keys discovered in /etc/postfix-or-exim configs or via cached SMTP submission credentials.

The fix in 4.99.3 resets the input processing stack and discards any stale buffer references when a TLS close_notify alert is observed during an active BDAT receive, eliminating the path through ungetc() into freed memory. No standalone configuration workaround eliminates the vulnerability; disabling CHUNKING (chunking_advertise_hosts = : in exim.conf) blocks the trigger but is operationally disruptive and not a vendor-recommended substitute for patching.

Detection should prioritize: (1) network telemetry for SMTP sessions that combine BDAT with a TLS alert mid-transfer; (2) zeek smtp.log entries showing BDAT followed by abrupt TLS termination; (3) exim panic log entries near process crash signatures; (4) auditd execve telemetry from the exim user spawning shell or networking binaries; (5) outbound connections from MTAs to non-mail destinations.

MITRE ATT&CK techniques used in TL-2026-0513

Credential Access

T1003 OS Credential Dumping; T1040 Network Sniffing; T1552 Unsecured Credentials

Collection

T1005 Data from Local System; T1114 Email Collection

Discovery

T1018 Remote System Discovery; T1057 Process Discovery; T1083 File and Directory Discovery

Lateral Movement

T1021 Remote Services

Defense Evasion

T1036 Masquerading; T1070 Indicator Removal; T1574 Hijack Execution Flow

Exfiltration

T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol

Persistence

T1053 Scheduled Task/Job; T1505 Server Software Component; T1543 Create or Modify System Process

Execution

T1059 Command and Scripting Interpreter; T1106 Native API

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Impact

T1496 Resource Hijacking; T1565 Data Manipulation

Resource Development

T1587 Develop Capabilities; T1588 Obtain Capabilities

Reconnaissance

T1590 Gather Victim Network Information; T1595 Active Scanning

Affected products and versions in Dead.Letter — CVE-2026-45185 Unauthenticated Pre-Auth RCE in

  • Exim — Exim MTA
    Vulnerable versions: 4.97; 4.97.1; 4.98; 4.98.1; 4.98.2; 4.99; 4.99.1; 4.99.2
    Fixed in: 4.99.3
  • Debian — exim4 (debian package)
    Vulnerable versions: 4.98.x in trixie before 4.98.2-1+deb13u2; 4.96.x in bookworm before 4.96-15+deb12u9; 4.94.2 in bullseye before 4.94.2-7+deb11u5
    Fixed in: 4.98.2-1+deb13u2 (trixie); 4.96-15+deb12u9 (bookworm); 4.94.2-7+deb11u5 (bullseye)
  • Canonical — Ubuntu exim4
    Vulnerable versions: Ubuntu 24.04 LTS exim4 before USN-7100-1; Ubuntu 22.04 LTS exim4 before USN-7100-1; Ubuntu 20.04 LTS exim4 before USN-7100-1
    Fixed in: Ubuntu 24.04 LTS exim4 after USN-7100-1; Ubuntu 22.04 LTS exim4 after USN-7100-1
  • cPanel — WHM with bundled Exim
    Vulnerable versions: cPanel & WHM with bundled exim before vendor patch
    Fixed in: cPanel & WHM with vendor patch shipping Exim 4.99.3
  • Synology — Synology Mail Server
    Vulnerable versions: Synology Mail Server packages using Exim before vendor patch
    Fixed in: Synology Mail Server with Exim 4.99.3

Remediation for Dead.Letter — CVE-2026-45185 Unauthenticated Pre-Auth RCE in

Patches

  • Exim 4.99.3 (upstream, released 2026-05-12)
  • Debian DSA-6265-1 (exim4 4.98.2-1+deb13u2 for trixie, 4.96-15+deb12u9 for bookworm, 4.94.2-7+deb11u5 for bullseye)
  • Ubuntu security update for 24.04 LTS, 22.04 LTS, and supported releases (USN coordinated with upstream disclosure)
  • Vendor-shipped appliances: cPanel, Plesk, and Synology Mail Server users must upgrade through vendor channels

Immediate actions

  • Upgrade Exim to 4.99.3 or later on all internet-facing mail servers immediately
  • Apply Debian DSA-6265-1 packages (exim4 4.98.2-1+deb13u2, 4.96-15+deb12u9, 4.94.2-7+deb11u5) on Debian stable/oldstable/oldoldstable
  • Apply Ubuntu security updates for 24.04 LTS and other supported releases
  • Restart the exim4 service after upgrade — running processes retain the vulnerable code path
  • Inspect exim panic log (/var/log/exim4/paniclog) for crash signatures consistent with BDAT-during-close_notify since 2026-04-01
  • Hunt for anomalous SMTP sessions combining BDAT with mid-transfer TLS alerts using zeek smtp.log and conn.log

Workarounds

  • Temporary: disable CHUNKING advertisement via 'chunking_advertise_hosts = :' in exim.conf — blocks trigger but breaks RFC 3030 chunked transfers for clients that require BDAT
  • Temporary: switch the build to OpenSSL where the vulnerable code path is not reached — not exploitable in OpenSSL builds, but requires rebuild and is not a vendor-recommended substitute for the official patch
  • Temporary: rate-limit SMTP connections per source IP via fail2ban or in-front NGINX stream proxy to slow heap-grooming exploits — does not prevent exploitation, only delays it

Longer-term hardening

  • Inventory every internet-facing SMTP listener; many MTA instances are deployed by infrastructure-as-code or shipped within appliances and are not in CMDB
  • Adopt EDR with behavioral detection of MTA processes spawning shell or networking binaries (execve of /bin/sh, /usr/bin/python, /usr/bin/curl, /usr/bin/wget from exim user)
  • Restrict outbound egress from mail servers to only required destinations (TCP/25 to peer MTAs, NTP, DNS, package mirrors)
  • Place internet-facing MTAs behind dedicated egress proxies that log all outbound flows
  • Adopt build-flag transparency for Linux distributions so USE_GNUTLS vs USE_OPENSSL is visible to security teams without inspecting package builds
  • Treat mail server compromise as a credential-exposure event — rotate any service credentials accessible from /var/spool/exim4 or /etc/exim4

CVEs associated with Dead.Letter — CVE-2026-45185 Unauthenticated Pre-Auth RCE in

CVE-2026-45185

Weaknesses (CWE) in Dead.Letter — CVE-2026-45185 Unauthenticated Pre-Auth RCE in

CWE-416, CWE-787, CWE-672

Timeline of Dead.Letter — CVE-2026-45185 Unauthenticated Pre-Auth RCE in

  • XBOW Security Lab begins targeted vulnerability research on Exim under its Mythos AI-driven native-code analysis program, focusing on the BDAT/CHUNKING and TLS state-machine interfaces.
  • Federico Kirschbaum and Andres Luksenberg identify the use-after-free primitive: ungetc() into a freed state->xfer_buffer triggered by TLS close_notify mid-BDAT followed by a cleartext byte on the same TCP connection.
  • XBOW reports CVE-2026-45185 to the Exim maintainers under coordinated disclosure with a working ASLR-bypass exploit demonstrating pre-auth RCE.
  • Exim maintainers confirm the bug and begin developing the fix; the input-processing stack reset path is selected to eliminate stale pointer reuse on close_notify.
  • Patch in tls-gnu.c and receive.c circulated to a small group of downstream distribution security teams (Debian, Ubuntu) under embargo for coordinated release.
  • Exim 4.99.3 released upstream. XBOW publishes the Dead.Letter blog and technical writeup. The Hacker News publishes coverage.
  • Threadlinqs honeypots and partner sensors observe initial reconnaissance scanning of TCP/25 with EHLO probes consistent with capability fingerprinting; no successful exploitation observed yet, but volume of BDAT-capability probes increases sharply.
  • Debian DSA-6265-1 and Ubuntu USN-7100-1 published. CyCognito and other analysis blogs publish emerging-threat advisories. Threadlinqs Intelligence opens TL-2026-0513.
  • As of 2026-05-29, CVE-2026-45185 ("Dead.Letter") is patched (Exim 4.99.3, Debian DSA-6265-1, Ubuntu USN-7100-1) with no confirmed in-the-wild RCE and not yet in CISA KEV. It remains a live concern: a default-config CVSS 9.8 pre-auth RCE with a working XBOW PoC, hundreds of thousands of unpatched internet-facing servers, and active recon scanning.

Sources cited for Dead.Letter — CVE-2026-45185 Unauthenticated Pre-Auth RCE in

Threats related to Dead.Letter — CVE-2026-45185 Unauthenticated Pre-Auth RCE in

Detection coverage for TL-2026-0513

As of 2026-05-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0513 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats