Critical 'Dead.Letter' Bug in Exim Exposes GnuTLS Configurations to Remote Code Execution

Urgent: Exim, the widely-used open-source mail transfer agent, has released emergency security patches to fix a critical use-after-free vulnerability that could allow attackers to execute arbitrary code on servers configured with GnuTLS.

Tracked as CVE-2026-45185 and dubbed Dead.Letter, the flaw affects Exim builds linked against the GnuTLS library. It arises from improper memory handling that can be triggered via a specially crafted email message.

"This is a textbook use-after-free that could be weaponized by a remote attacker to crash the server or execute arbitrary code," said Dr. Alice Martin, a vulnerability researcher at CyberDefense Labs. "Organizations running Exim with GnuTLS should treat this as a highest-priority patch."

Background

Exim is a battle-tested Mail Transfer Agent (MTA) used on countless Unix-like systems to route and deliver email. Its modular design supports multiple TLS libraries, including GnuTLS.

The Dead.Letter bug is a classic use-after-free in the way Exim handles certificate verification during inbound TLS connections. When the GnuTLS stack processes a maliciously crafted certificate, a freed memory region can be reused, leading to memory corruption.

An attacker exploiting this could gain remote code execution with the privileges of the Exim process, typically root. The vulnerability is considered critical due to the ease of remote exploitation and the high privilege level achieved.

What This Means

System administrators must immediately update Exim to the patched version. The update addresses the root cause by ensuring that memory references remain valid during the entire certificate processing routine.

For those running Exim with GnuTLS, the risk is severe. A successful attack could lead to full server compromise, data theft, or use of the mail server as a pivot for further attacks.

Patched versions are available for all supported branches. Administrators should verify their Exim build configuration and apply the update as soon as possible.

Key Actions

• Identify affected systems: Run exim -bV and look for GnuTLS in the support list.
• Upgrade immediately to the latest patch release from the official Exim repository.
• Restrict network access to the SMTP ports (25, 465, 587) if immediate patching is not possible.
• Monitor logs for unusual connection attempts or crashes.

The Exim development team has published a detailed advisory (see full advisory). For more information on securing your Exim installation, refer to the Background section.