FRESH

Hacker News

Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim

71 points by fedek_

by kro

2 subcomments

It says coordinated distro release today, and I've received a notice earlier today but that does not include the CVE number. That's confusing / does not seem very coordinated to release 2 separate security update notices in a day.
https://lists.debian.org/debian-security-announce/2026/msg00...

by ofjcihen

2 subcomments

>What follows is, before anything else, a story. One of those old, well-worn ones.
Gag.

by tardedmeme

0 subcomment

I've vouched no less than four reasonable comments under this post. Was there a mass flagging campaign?

by eqvinox

0 subcomment

by fulafel

1 subcomments

Previously (2023): https://www.bleepingcomputer.com/news/security/millions-of-e...
Previously (2020): https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE...
Previously (2019): https://www.cvedetails.com/vulnerability-list/vendor_id-1091...

by stackghost

2 subcomments

>The bug is a use-after-free triggered when a TLS connection is handled by GnuTLS
Color me surprised. The GNU ecosystem has had more than its fair share of CVEs over the years to the point that it's now a common trope:
https://soatok.blog/2020/07/08/gnu-a-heuristic-for-bad-crypt...

by aftbit

2 subcomments

by nhattruongadm

0 subcomment

The finding method is almost as interesting as the bug itself. XBOW is an AI-based offensive security tool, and UAF bugs at library integration points are exactly the kind of thing that slips past human code review — reviewers focus on protocol logic, not on what happens to object lifetimes when a TLS session tears down mid-flight in an error path.
There's a pattern here worth noting: the riskiest attack surfaces in complex C software often aren't in the core logic but at integration boundaries — where one component (Exim) makes assumptions about object lifecycles managed by another (GnuTLS). Those boundaries require simultaneous deep familiarity with both codebases, which is cognitively expensive for humans but maps well to automated analysis.
This is also why "use a well-audited TLS library" doesn't fully transfer safety — you inherit the library's correctness guarantees only for the paths the library authors tested, not for how you call it under load or error conditions.

by alpb

2 subcomments

Never heard of Exim, I'm just realizing what it is:
> Exim is an open-source Mail Transfer Agent (MTA) designed for Unix-like systems to receive, route, and deliver email.
what's the significance of this? do people use this in production systems?