Executive brief
OX Dovecot is a mail server component that handles email delivery and storage. An authenticated attacker can craft a malicious Sieve filter script to trigger a use-after-free memory vulnerability in the mail editing code, potentially allowing them to corrupt memory, leak sensitive data, crash the mail delivery process, or execute arbitrary code with the privileges of the mail delivery service.
Technical details
This vulnerability is a use-after-free flaw in OX Dovecot's mail editing code triggered via the Sieve editheader extension. An authenticated attacker with valid credentials can craft a specially formed Sieve filter script to access memory after it has been freed, causing memory corruption and information disclosure. The vulnerability affects mail delivery operations and may allow arbitrary code execution in the context of the mail delivery process. No publicly available exploits are currently known. Patches are available: update to OX Dovecot Pro 2.3.22.2, 3.0.7, or 3.1.6 and later, or disable the Sieve editheader extension as a workaround.
Affected products
- Open-Xchange Dovecot Pro 2.3.0 to 2.3.22.1, 3.0.0 to 3.0.6, 3.1.0 to 3.1.5
Timeline
- 2026-08-28: disclosed: Public disclosure of CVE-2026-42007
- 2026-08-26: advisory: Initial security advisory OXDC-ADV-2026-0003