Out-of-Bounds Read Vulnerability in Cyrus IMAP by The Cyrus Project

CVE-2026-61908

What is CVE-2026-61908?

A vulnerability exists in Cyrus IMAP versions prior to 3.12.4, where crafted JMAP email-header blob IDs can reference an out-of-bounds index. An authenticated user could exploit this issue by attempting to download a specially formatted JMAP blob ID in the form of H-. This action may lead to reading past the boundaries of the internal blob_headers array during the download process, resulting in exposure of adjacent heap memory, which can pose significant security risks.

References