New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution
Exim is an open-source Mail Transfer Agent (MTA) designed for Unix-like systems to receive, route, and deliver email. The vulnerability, tracked as CVE-2026-45185, aka Dead.Letter, has been described as a use-after-free vulnerability in Exim's binary data transmission (BDAT) message body parsing when a TLS connection is handled by GnuTLS.
Exim has released security updates to address a serious security issue affecting certain configurations that could allow memory corruption and possible code execution. Exim is an open-source Mail Transfer Agent (MTA) for email delivery, routing, and reception on Unix-like computers.
The vulnerability is known as Dead (CVE-2026-45185).Letter, when a TLS connection is managed by GnuTLS, has been identified as a use-after-free vulnerability in Exim's...