The Exim BDAT vulnerability, tracked as CVE-2026-45185 and also called “Dead.Letter,” is a serious reminder that email infrastructure remains a high-value attack surface. The flaw affects Exim versions 4.97 through 4.99.2 when built with GnuTLS and can lead to heap corruption with potential code execution during BDAT message handling over TLS.

Organizations running Exim should immediately verify whether their builds use GnuTLS, upgrade to Exim 4.99.3, and avoid assuming that mail servers are “set and forget” infrastructure. Email gateways sit at the edge of the organization, process untrusted input all day, and are often deeply integrated with internal systems. So naturally, one stale mail server can become the front door attackers were hoping someone forgot to lock.

Exim has released security updates to address a severe security issue affecting certain configurations that could enable memory corruption and potential code execution. Exim is an open-source Mail Transfer Agent (MTA) designed for Unix-like systems to receive, route, and deliver email. The vulnerability, tracked as CVE-2026-45185, aka Dead.Letter, has been described as a use-after-free

Source: New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution via The Hacker News — published 12 May 2026.