IMAP Vulnerability in Open-Xchange Dovecot Product

CVE-2026-42392

What is CVE-2026-42392?

A vulnerability exists in Open-Xchange's Dovecot product where an attacker with valid credentials can exploit an invalid IMAP URLFETCH command. This can result in the inclusion of uninitialized memory in error responses sent to the client, leading to the possible disclosure of sensitive process memory contents. To mitigate this risk, it is advised to disable the IMAP URLAUTH functionality and to promptly update to a non-vulnerable version of the software.

References