Dead.Letter (CVE-2026-45185): Unauthenticated RCE in Exim GnuTLS Builds — Patch Now

Sun, 21 Jun 2026 00:00:00 +0000

If you’re running Exim on Debian or Ubuntu and haven’t patched in the past five weeks, there’s a reasonable chance your mail server is remotely exploitable by anyone who can open a TLS connection to port 25. No credentials required. No special tooling. Standard SMTP commands.

CVE-2026-45185, nicknamed Dead.Letter, is a use-after-free vulnerability in Exim’s BDAT message parsing path. CVSS score: 9.8 Critical. Fixed in Exim 4.99.3, released May 12, 2026. If you haven’t checked your version since then, now would be a good time.

RCE on kalfaoglu.net

Dead.Letter (CVE-2026-45185): Unauthenticated RCE in Exim GnuTLS Builds — Patch Now