Executive brief
Dovecot's ManageSieve service, which allows remote management of email filtering scripts, contains a buffer overflow vulnerability triggered by malformed Sieve scripts. An authenticated attacker can crash the ManageSieve process, disrupting script management functionality. While no code execution exploits are currently known, the memory corruption could potentially be leveraged for remote code execution in future attacks.
Technical details
The vulnerability is an out-of-bounds write in the Sieve script compiler triggered by an extreme numeric literal in a maliciously crafted Sieve script. The attack requires valid credentials to submit the script via ManageSieve, and the flaw occurs during script compilation. Successful exploitation causes memory corruption and process crash, resulting in denial of service for the ManageSieve service. While no public exploits exist, the memory corruption nature of the bug makes it a potential vector for remote code execution if properly weaponized. Patched versions are available: 2.3.22.2, 3.0.7, and 3.1.6 or later.
Affected products
- Open-Xchange Dovecot 2.3.0 to 2.3.22.1, 3.0.0 to 3.0.6, 3.1.0 to 3.1.5
Timeline
- 2026-08-28: disclosed: Public disclosure via OX Dovecot Security Advisory OXDC-ADV-2026-0003
- 2026-08-28: patched: Fixed versions released: 2.3.22.2, 3.0.7, 3.1.6