Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim • Hacker News Board

It says coordinated distro release today, and I've received a notice earlier today but that does not include the CVE number. That's confusing / does not seem very coordinated to release 2 separate security update notices in a day.

https://lists.debian.org/debian-security-announce/2026/msg00...

Re: Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim

#7

Post by stackghost » Tue, May 12, 2026, 6:47 PM UTC

>The bug is a use-after-free triggered when a TLS connection is handled by GnuTLS

Color me surprised. The GNU ecosystem has had more than its fair share of CVEs over the years to the point that it's now a common trope:

https://soatok.blog/2020/07/08/gnu-a-heuristic-for-bad-crypt...

Re: Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim

#8

Post by tptacek » Tue, May 12, 2026, 6:54 PM UTC

rs_rs_rs_rs_rs wrote: post #5

kees99 wrote: post #4

Earlier quoted context omitted.

Nah, go straight for qmail. Give it your best try.

The usable qmail got owned by AI already, the unusable one not yet!

Not by AI, but by humans awhile ago. I think Qualys weaponized a wontfix LP64 integer overflow in it just a couple years ago?

Re: Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim

#9

Post by sys42590 » Tue, May 12, 2026, 6:54 PM UTC

aftbit wrote: post #2

Ok now do postfix

Many years ago I used Exim because it was default for my distro of choice back then. But after a few emergency patchings caused by yet another RCE in Exim I learned that switching to Postfix massively improved my sleep quality.

Re: Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim

#10

Post by tptacek » Tue, May 12, 2026, 7:06 PM UTC

sys42590 wrote: post #9

aftbit wrote: post #2

Ok now do postfix

Many years ago I used Exim because it was default for my distro of choice back then. But after a few emergency patchings caused by yet another RCE in Exim I learned that switching to Postfix massively improved my sleep quality.

There's a weird folk belief that Exim is a secure 2nd-generation MTA, but it's not; it's a 1st generation MTA, like Sendmail and Smail. The two "secure" 2nd generation MTAs are Postfix and qmail. You shouldn't use those either, really; there is no reason to run a memory-unsafe MTA, or, for that matter, an MTA that isn't backed by a real database.