Exim CVE-2026-45185: Critical RCE (Dead.Letter)

Published on 7 August 2026

Exim CVE-2026-45185 'Dead.Letter': Critical RCE in GnuTLS Builds

A critical use-after-free vulnerability has been discovered in the BDAT parser of Exim versions 4.97 to 4.99.2 (GnuTLS builds, the default on Debian/Ubuntu) (CVE-2026-45185, CVSS 9.8, alias: Dead.Letter). Unauthenticated attackers can corrupt the heap and achieve remote code execution via crafted SMTP BDAT commands. The patch is available in version 4.99.3. Exim is the world's most widely used mail transfer agent.

Short & clear answers

Frequently asked questions about this incident

Am I affected by the Exim vulnerability CVE-2026-45185?

Affected versions are Exim 4.97 through 4.99.2 in GnuTLS builds, which are the default on Debian, Ubuntu, and Debian-based distributions (e.g., Linux Mint, Raspberry Pi OS). Not affected are Exim builds using OpenSSL (typical on RHEL, CentOS, Fedora, SUSE) and managed services such as Google Workspace or Microsoft 365. You can check your TLS library with the command 'exim -bV'.

What do I need to do right now to protect myself?

Update Exim to version 4.99.3 immediately via your distribution's package manager and restart the service afterward. Debian users should upgrade to the patched packages (stable 4.98.2-1+deb13u2, oldstable 4.96-15+deb12u9, oldoldstable 4.94.2-7+deb11u5). According to Exim and CERT Uganda there is no configuration workaround – only the update fixes the issue.

How dangerous is this vulnerability?

The vulnerability is rated critical with a CVSS score of 9.8. Unauthenticated attackers can corrupt the heap via crafted SMTP BDAT commands and achieve remote code execution. An attacker only needs to be able to establish a TLS connection and use the CHUNKING (BDAT) SMTP extension.

Is there a temporary workaround if I can't update immediately?

No. Both the Exim maintainers and CERT Uganda explicitly state that no configuration workaround exists. The only effective measure is upgrading to Exim 4.99.3.

Do I have to report this incident under GDPR?

If your Exim server was successfully attacked and personal data could be affected, a reporting obligation under Art. 33 GDPR may apply. Check your server logs for suspicious BDAT activity and consult your data protection officer if in doubt. Merely running the vulnerable version without a compromise generally does not trigger a reporting obligation.

More security news