TI-2026-44292 Aliases CVE-2026-61908 GHSA-2x93-wv63-897r

Out-of-bounds read in cyrusimap Cyrus IMAP

LOW 28CWE-125Published 2026-09-09 · Updated 2026-09-10

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Partial Red Hat: 5 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H<emailid>-<index>, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00224 13th percentileScored 2026-11-07

Fix Partial Cyrus IMAP (cyrusimap): 3.8.8, 3.10.4, 3.12.4Red Hat: 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
cyrusimap	Cyrus IMAP	before 3.8.8; 3.9.0 to before 3.10.4; 3.11.0 to before 3.12.4	3.8.8, 3.10.4, 3.12.4	Patch available	CNA

Cyrus IMAP Vendorcyrusimap Affected before 3.8.8; 3.9.0 to before 3.10.4; 3.11.0 to before 3.12.4 Fixed in 3.8.8, 3.10.4, 3.12.4 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cyrus:imap::::::::	before 3.8.8; 3.9.0 to before 3.10.4; 3.11.0 to before 3.12.4	Vulnerable	Cyrus

cpe:2.3:a:cyrus:imap:*:*:*:*:*:*:*:* Versions before 3.8.8; 3.9.0 to before 3.10.4; 3.11.0 to before 3.12.4 Vulnerable ·Cyrus

Remediation

Fix · CNA Cyrus IMAP (cyrusimap) Fixed in 3.8.8, 3.10.4, 3.12.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-09-09
cyrusimap Cyrus IMAP 3.10.4, 3.12.4, 3.8.8
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2026-44296 Double free in cyrusimap Cyrus IMAPPriority LOW 31
- TI-2026-44294 Incorrect authorization in cyrusimap Cyrus IMAPPriority LOW 22
- TI-2026-44295 An issue was discovered in Cyrus IMAP before 3.12.4.Priority LOW 19
Show all 6 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-61908
2026-10-03 Alias added: GHSA-2x93-wv63-897r

References

Other 4

TI-2002-01271 Multiple buffer overflows in Cyrus SASL library 2.1.9 and earlier allow remote attackers… CVSS 3.1CRITICAL 9.8
TI-2022-08283 In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the… CVSS 3.1HIGH 8.8
TI-2019-14353 cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated… CVSS 3.1HIGH 7.5
TI-2026-44296 Double free in cyrusimap Cyrus IMAP CVSS 3.1HIGH 7.1
TI-2017-09510 Cyrus IMAP before 3.0.3 allows remote authenticated users to write to arbitrary files via… CVSS 3.0MEDIUM 6.5
TI-2024-22515 Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to… CVSS 3.1MEDIUM 6.5

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences