Executive brief
OX Dovecot is an open-source mail server component that handles IMAP (email) protocol communication. An authenticated attacker can send a malformed IMAP command that causes the server to leak uninitialized memory in error responses, potentially exposing sensitive data such as passwords, session tokens, or other confidential information from server memory.
Technical details
The vulnerability is an information disclosure flaw in the IMAP URLFETCH implementation. An attacker with valid IMAP credentials can craft an invalid URLFETCH command that triggers a code path where uninitialized memory is included in the error response sent back to the client. This is a classic use-after-free or buffer overread style memory disclosure. The attack requires valid authentication credentials and network access to the IMAP service. The impact is limited to information disclosure; no code execution or privilege escalation is possible. Patches are available in versions 2.3.22.2, 3.0.7, and 3.1.6 or later.
Affected products
- Open-Xchange Dovecot Pro 2.3.0 to 2.3.22.1, 3.0.0 to 3.0.6, 3.1.0 to 3.1.5
Timeline
- 2026-08-28: disclosed: Public disclosure of CVE-2026-42392
- 2026-08-28: patched: Patches released for versions 2.3.22.2, 3.0.7, and 3.1.6