Topic starter
19/08/2026 3:50 pm
TL;DR: Exim CVE-2026-45185, or Dead.Letter, is a critical use-after-free flaw in the BDAT parsing path that can let an unauthenticated network attacker execute code on internet-facing mail servers, according to CYCOGNITO. The issue is a reminder that exposed SMTP services, default-enabled protocol features, and privileged mail daemons create a narrow but dangerous attack window when patching lags.
Editorial analysis by NHI Mgmt Group, based on content published by CYCOGNITO: “Emerging Threat: (CVE-2026-45185) Exim Remote Code Execution via BDAT over GnuTLS”.
Key questions
Q: What fails first in Exim Dead.Letter when the vulnerability is triggered?
A: The failure starts in the BDAT parsing path during TLS shutdown, where Exim can free a transfer buffer while the SMTP state machine still references it.
Q: Why does this vulnerability matter more on internet-facing mail servers?
A: Because exploitation is unauthenticated and needs only a reachable SMTP service that supports STARTTLS and CHUNKING.
Q: What signs suggest an Exim deployment may still be exposed?
A: Look for public SMTP listeners that advertise both STARTTLS and CHUNKING, especially where the host runs Exim 4.97 through 4.99.2 with GnuTLS linkage.
Practitioner guidance
- Verify the running Exim build, not just the package name Confirm the installed binary is linked against the patched code path and that the host is running Exim 4.99.3 or the vendor-fixed package for the relevant distribution.
- Inventory every public SMTP listener Identify internet-facing services on TCP/25, TCP/465, and TCP/587 that advertise STARTTLS and CHUNKING, then prioritise them for immediate validation.
- Remove exposed relay scope where public SMTP is unnecessary Restrict mail server access to known relay peers and internal source ranges when the service does not need to accept the public internet as a client.
Bottom line: Dead.Letter shows how a memory-safety bug in a privileged mail daemon can turn standard SMTP handling into remote code execution.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:26 pm
Dead.Letter is a service-process trust failure, not just a bug in mail parsing. Exim sits in a privileged position on the edge of many estates, and that privilege turns a memory-safety flaw into an access problem. The important governance question is not only whether the CVE is patched, but whether teams can identify every externally reachable mail process that can be driven through the vulnerable path. Practitioners should treat exposed MTA inventory as part of identity and server governance, not just vulnerability scanning.
A question worth separating out:
Q: Should teams prioritise patching Exim or restricting SMTP exposure first?
A: Patch first when the server is internet-facing, because the vulnerability is already reachable through normal protocol behaviour. Restricting relay access helps reduce attack surface, but it does not remove the flaw from an externally reachable daemon that still accepts the vulnerable sequence.
👉 Read our full editorial: Exim Dead.Letter shows how one mail flaw becomes remote code execution