EXE, yeah.
Doesn't matter how hard you punch or how big a Kaiju you are when someone can and will just soulhax you. Even on a more meta level, RED is just an evil spirit or a tumor or something (it's left vague) in a game while EXE is directly stated to fully control the entire hard drive of the computer he's on, meaning EXE can basically control the entire world RED makes.
Sure, RED has better control of the "Real World", since he can kill someone over time while EXE needs victims to complete his game, but he's still in a game world, while the Sonic.EXE game is more or less a window into EXE's own world which is considered to be on more or less the same level as the "Real" world. And with how much time RED's heart attacks take, not to mention that EXE might not even need or have a heart, it's only a matter of time before EXE uses one of his haxes. They're also both extremely sadistic, so those aspects kind of cancel each other out.
Although,
Shadow of Red might let Red get the win regardless. Honestly, it's actually a surprisingly interesting matchup to debate.