Executive brief
Cyrus IMAP is a widely used mail server for managing and delivering email. A security flaw allows an authenticated user to trick the server into reading sensitive information from its internal memory by sending a specially formatted email. This could potentially expose private data from other users or system processes to the attacker.
Technical details
A buffer over-read (CWE-126) exists in the nested MIME comment parsing logic of cyrus-imapd. By crafting an email containing an RFC 822 comment that ends with a backslash, an authenticated IMAP user can trigger a condition where the parser reads past the end of the message buffer. This results in the server reading adjacent heap memory and returning that data to the user. The vulnerability is present in versions up to 3.12.2 and is fixed in version 3.12.3. Exploitation requires network access and valid user credentials.
Affected products
- Cyrus Cyrus IMAP up to 3.12.2
Timeline
- 2026-07-16: advisory: NVD publication date
- 2026-07-16: patched: Release of version 3.12.3