# Dead.Letter — CVE-2026-45185 Unauthenticated Pre-Auth RCE in Exim via Use-After-Free in BDAT/GnuTLS

> CVE-2026-45185 ("Dead.Letter") is a critical unauthenticated pre-auth remote code execution vulnerability in the Exim MTA. A use-after-free is triggered when a client sends a TLS close_notify alert during an active BDAT (CHUNKING) transfer and then transmits a final cleartext byte on the same TCP connection. Exim's nested BDAT receive wrapper calls ungetc() into a buffer (state->xfer_buffer) already freed during TLS shutdown, corrupting glibc allocator metadata and seeding heap-shaping primitives that XBOW researchers used to achieve full RCE against an ASLR-enabled target. The bug affects Exim 4.97 through 4.99.2 built with USE_GNUTLS=yes — the default on Debian, Ubuntu, and Debian-derived distributions. OpenSSL-linked builds (typical on RHEL/SUSE) are not vulnerable. Fixed in Exim 4.99.3 on 2026-05-12.

- **Published:** 2026-05-13T12:00:00Z
- **Last reviewed:** 2026-05-13T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0513
- **ID:** TL-2026-0513
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-45185

## Description

Dead.Letter (CVE-2026-45185) is a pre-authentication remote code execution flaw in Exim — the most widely deployed Internet MTA and the default mail server on Debian and Ubuntu. The vulnerability is rooted in an unsafe interaction between Exim's BDAT/CHUNKING receive path and GnuTLS shutdown handling: under a precisely-shaped TCP/TLS sequence, Exim's nested BDAT receive wrapper retains a stale pointer to a TLS transfer buffer (state->xfer_buffer) that has already been freed by the GnuTLS teardown path, then performs an ungetc() that writes a single byte (newline, 0x0A) into the freed allocation. The freed slot lies in glibc's tcache/fastbin range and the write reliably lands on allocator metadata, providing the foothold required for subsequent heap-shaping primitives. The bug class is a classic use-after-free (CWE-416) compounded by an out-of-bounds write into reclaimed heap (CWE-787).

The exploit primitive is reached entirely pre-authentication. An attacker opens a TCP connection to TCP/25, TCP/465, or TCP/587, negotiates STARTTLS, issues MAIL FROM/RCPT TO followed by BDAT <N> to begin a chunked transfer, then sends a TLS close_notify alert mid-transfer and follows up with one cleartext byte on the same socket. STARTTLS and CHUNKING are both advertised by default on internet-facing Exim deployments, so no non-default configuration is required for exposure. Telemetry observed during pre-disclosure scanning suggests several hundred thousand internet-reachable Exim instances meet the trigger preconditions.

Following the initial UAF write, the XBOW exploit chain pivots through three stages: (1) heap grooming via repeated MAIL FROM and BDAT command issuance to shape tcache freelists into a desired allocator state; (2) arbitrary-read primitive constructed from a corrupted message header pointer to defeat ASLR and locate libc/the Exim text segment; (3) GOT-style overwrite of a function pointer in Exim's exec-resolver path to redirect control flow into an attacker-controlled ROP chain, ultimately calling system() with an attacker-controlled string. The XBOW disclosure includes a working ASLR-bypass exploit; the underlying primitive is also addressable from rop-chain-only and write-what-where-only paths, so additional public exploits should be expected rapidly.

Exim runs as the unprivileged "Debian-exim"/"exim" user on modern Debian and Ubuntu, but the binary frequently has access to a delivery agent setuid helper (exim4 in /usr/sbin) and writes to /var/spool/exim4 and /var/log/exim4. Local privilege escalation paths from the exim user are well-documented historically (CVE-2019-10149 and family). Post-exploitation we expect adversaries to: (a) install persistence via exim's filter or routers configuration; (b) use the compromised MTA as a high-trust pivot for outbound phishing, since the host frequently has unrestricted egress on TCP/25 and high reputation; (c) read in-transit messages from /var/spool/exim4 for credential and password-reset interception; (d) move laterally via SSH/keys discovered in /etc/postfix-or-exim configs or via cached SMTP submission credentials.

The fix in 4.99.3 resets the input processing stack and discards any stale buffer references when a TLS close_notify alert is observed during an active BDAT receive, eliminating the path through ungetc() into freed memory. No standalone configuration workaround eliminates the vulnerability; disabling CHUNKING (chunking_advertise_hosts = : in exim.conf) blocks the trigger but is operationally disruptive and not a vendor-recommended substitute for patching.

Detection should prioritize: (1) network telemetry for SMTP sessions that combine BDAT with a TLS alert mid-transfer; (2) zeek smtp.log entries showing BDAT followed by abrupt TLS termination; (3) exim panic log entries near process crash signatures; (4) auditd execve telemetry from the exim user spawning shell or networking binaries; (5) outbound connections from MTAs to non-mail destinations.

## MITRE ATT&CK

- T1595 Active Scanning
- T1590 Gather Victim Network Information
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1505 Server Software Component
- T1543 Create or Modify System Process
- T1053 Scheduled Task/Job
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1070 Indicator Removal
- T1036 Masquerading
- T1574 Hijack Execution Flow
- T1003 OS Credential Dumping
- T1552 Unsecured Credentials
- T1040 Network Sniffing
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1018 Remote System Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1114 Email Collection
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1048 Exfiltration Over Alternative Protocol
- T1496 Resource Hijacking
- T1565 Data Manipulation

## Sources

- [Dead.Letter (CVE-2026-45185) — How XBOW Found an Unauthenticated RCE on Exim](https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim)
- [New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution](https://thehackernews.com/2026/05/new-exim-bdat-vulnerability-exposes.html)
- [Emerging Threat: CVE-2026-45185 Exim Remote Code Execution via BDAT over GnuTLS](https://www.cycognito.com/blog/emerging-threat-cve-2026-45185-exim-remote-code-execution-via-bdat-over-gnutls/)
- [Exim 4.99.3 Release Notes](https://github.com/Exim/exim/releases/tag/exim-4.99.3)
- [NVD — CVE-2026-45185](https://nvd.nist.gov/vuln/detail/CVE-2026-45185)
- [Debian Security Advisory DSA-6265-1 — exim4](https://www.debian.org/security/2026/dsa-6265)
- [Ubuntu Security Notice USN-7100-1 — exim4](https://ubuntu.com/security/notices/USN-7100-1)
- [RFC 3030 — SMTP Service Extensions for Transmission of Large and Binary MIME Messages (CHUNKING/BDAT)](https://datatracker.ietf.org/doc/html/rfc3030)
- [GnuTLS Reference — gnutls_record_recv and close_notify behaviour](https://www.gnutls.org/manual/html_node/Data-transfer-and-termination.html)
- [XBOW Security Lab — Mythos Vulnerability Research Platform](https://xbow.com/research/mythos)
- [Exim source tree — receive.c BDAT processing](https://github.com/Exim/exim/blob/exim-4.99.3/src/src/receive.c)
- [Exim source tree — tls-gnu.c GnuTLS shutdown path](https://github.com/Exim/exim/blob/exim-4.99.3/src/src/tls-gnu.c)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0513