Exim Vulnerability CVE-2026-45185: What Mail Server Admins Should Know

CVE-2026-45185 ‘Dead.Letter’ Exim Vulnerability: Patching Advice

CVE-2026-45185 Dead.Letter is a use-after-free vulnerability in Exim’s BDAT (chunking) message-body handling leading to remote code execution. Exim 4.99.3 has been released, patching the issue, and the versions 4.99.4 have been released with additional improvements. Affected installations should apply the patch as it allows for remote code execution when an unauthenticated attacker establishes a TLS connection and sends a specially-crafted sequence of data.

CVE What is it

Exim’s BDAT handler suffers from a use-after-free vulnerability that could be triggered by a client sending a TLS close_notify alert while a BDAT transfer was in progress, and a final byte of plaintext in the same connection. CVE-2026-45185. Attackers could exploit this vulnerability to execute arbitrary code within the context of the Exim process on vulnerable mail servers. Upstream Exim now includes a fix that causes the input processing stack to be destroyed when receiving a TLS close notification during a BDAT transfer, thus preventing any use of potentially dangling pointers.

• Mail servers with Exim versions 4.97–4.99.2, compiled with USE_GNUTLS=yes are vulnerable
• The most widespread setups are Exim-running VPSes, dedicated mail servers, Exim-running shared hosting nodes, and Exim-running cPanel/WHM server instances, built against GnuTLS instead of OpenSSL
• The binary is also exposed to extensions systems that disable CHUNKING BDAT SMTP extension at run-time. Checking should be done both at build-time and run-time.

Risk Evaluation

An unauthenticated remote attacker could exploit this vulnerability to gain remote code execution as the exim process, leading to possible email interception, server compromise, data exfiltration, and network infiltration. CVE-2026-45185 has a CVSS v3.1 base score of 9.8 (Critical), according to the researchers – it is one of the most severe Exim vulnerabilities in recent years, due to its high-risk impact and remote exploitability without requiring extensive attack surface. The attack requires being able to open a TLS SMTP session and use BDAT, which is available on any server that accepts TLS connections on ports 25, 587, or 465.

Check for the Vulnerability

Check the Exim version on your server by running exim -bV or exim4 -bV on the shell prompt to see which version is currently used. You will be able to see the version, as well as the build options. You need to ensure that the build option USE_GNUTLS was set during the Exim installation.

For Debian/Ubuntu, you can check what exim4 version is installed with the apt policy exim4 command or, alternatively, by using the dpkg -l | grep exim command.

You need to ensure that the build uses GnuTLS and falls within the 4.97-4.99.2 range, which would render the server vulnerable. The server should consider itself vulnerable until proven otherwise, after you perform an upgrade.

Review the Exim configuration and the logs to see if BDAT or CHUNKING were negotiated in any SMTP sessions. If they were, you are potentially vulnerable. Check the documentation to see whether CHUNKING/BDAT is enabled by default or advertised.

How to Patch

The upstream vendor released Exim version 4.99.3 which contains a fix for this vulnerability. You could upgrade to 4.99.3 or newer to patch the vulnerability fully. Following are the instructions for different Linux distributions:

Debian / Ubuntu

Update the package list and upgrade exim4:

apt update && apt install --only-upgrade exim4

Then, verify the version with exim4 -bV and ensure it is 4.99.3 or newer. You need to restart the exim service:

systemctl restart exim4 && systemctl reload exim4

RHEL / CentOS / AlmaLinux / Rocky Linux

Either dnf or yum will update exim:

dnf update exim or yum update exim

Restart the service after the package is updated:

systemctl restart exim or systemctl reload exim

Check the installed version with:

rpm -qa | grep exim and exim -bV

Alpine Linux:

apk update && apk upgrade exim

then check the version with exim -bV and restart the service.

If you compiled Exim from source code:

It is essential to follow your change control procedures when updating production software. Get upstream tarballs for 4.99.3( or newer), if applicable, and rebuild exim with the same compile-time options as before (make sure to update GNUTLS libraries if advised to do so). Then, verify that exim -bV shows version 4.99.3 or newer.

Testing the Upgrade

Ensure the mail delivery works correctly. You can send and receive test messages based on common scenarios (SMTP submission, incoming mail, local delivery), and look for regressions.

Look for any BDAT/TLS-related irregularities that might suggest that the upgrade did not succeed. If you updated exim, look for other suspicious activity in the logs before the upgrade. Some indicators of compromise that you may want to look for are:

Suspicious commands that may indicate an attacker interacting with the mail server.

Unusual scripts execution attempts.

Unusual entries in the logs that may suggest that the attacker is trying to use a vulnerability.

Compromise of local accounts or other resources on the mail server.

Queue irregularities, including unexpected messages in the queue and increases in volume that may suggest abuse.

Additionally, make sure that exim service starts correctly and does not have any issues, such as core dumps or other problems.

Avoidance

In addition to addressing this particular vulnerability, you should always follow the best practices for securing mail servers. It includes: patching as soon as possible, reducing the exposed surface, using supported TLS libraries, hardening the administrative accounts, and having effective logging and auditing practices. In the case of compromise, regular backups and tested recovery procedures will help limit the downtime and facilitate recovery.

Closing Remarks

A use-after-free vulnerability in Exim’s BDAT processing leading to remote code execution CVE-2026-45185 vulnerability is critical and should be addressed as soon as possible. The main mitigation is to upgrade to Exim 4.99.3 or newer, check the logs for possible evidence of exploitation, and use temporary mitigations if an immediate upgrade is not possible.

FAQ