New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution

"The vulnerability is triggered during BDAT message body handling when a client sends a TLS close_notify alert before the body transfer is complete, and then follows up with a final byte in cleartext on the same TCP connection. This sequence of events can cause Exim to write into a memory buffer that has already been freed during the TLS session teardown, leading to heap corruption. An attacker only needs to be able to establish a TLS connection and use the CHUNKING (BDAT) SMTP extension."

"Exim has released security updates to address a severe security issue affecting certain configurations that could enable memory corruption and potential code execution. The vulnerability, tracked as CVE-2026-45185, aka Dead.Letter, has been described as a use-after-free vulnerability in Exim's binary data transmission (BDAT) message body parsing when a TLS connection is handled by GnuTLS."

"During TLS shutdown, Exim frees its TLS transfer buffer - but a nested BDAT receive wrapper can still process incoming bytes and end up calling ungetc(), which writes a single character (\n) into the freed region. That one-byte write lands on Exim's allocator metadata, corrupting the allocator's internal shape; the exploit then leverages that corruption to gain further primitives."

"The issue impacts all Exim versions from 4.97 up to and including 4.99.2. That said, it only affects builds that use USE_GNUTLS=yes, meaning builds that rely on other TLS libraries like OpenSSL are not impacted."

Exim released security updates for CVE-2026-45185, also known as Dead.Letter. The flaw is a use-after-free in BDAT message body parsing when a TLS connection is handled by GnuTLS. The vulnerability is triggered when a client sends a TLS close_notify alert before the BDAT body transfer completes, then sends a final byte in cleartext on the same TCP connection. This sequence can cause Exim to write into a memory buffer that was freed during TLS session teardown, leading to heap corruption. Exploitation requires establishing a TLS connection and using the CHUNKING (BDAT) SMTP extension. Affected versions range from 4.97 through 4.99.2, but only builds compiled with USE_GNUTLS=yes are impacted.

Read at The Hacker News