cyrus-imapd: cyrus-imapd: JMAP email-header blob ID out-of-bounds index
Published Sep 9, 2026
6.5
MEDIUMCVSS 3.1
EPSS 0.22%
Description
An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H<emailid>-<index>, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.
Affected products
-
- Version 0StatusaffectedConstraints<3.8.8
- Version 3.11.0StatusaffectedConstraints<3.12.4
- Version 3.9.0StatusaffectedConstraints<3.10.4
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Cyrusimap | Cyrus IMAP | unaffected |
|
No data.
Red Hat Enterprise Linux 10
cyrus-imapd
Fix deferred
Red Hat Enterprise Linux 6
cyrus-imapd
Out of support scope
Red Hat Enterprise Linux 7
cyrus-imapd
Fix deferred
Red Hat Enterprise Linux 8
cyrus-imapd
Fix deferred
Red Hat Enterprise Linux 9
cyrus-imapd
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | cyrus-imapd | Fix deferred | n/a |
| Red Hat Enterprise Linux 6 | cyrus-imapd | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | cyrus-imapd | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | cyrus-imapd | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | cyrus-imapd | Fix deferred | n/a |
No package ranges for this CVE.
Remediation
Red Hat mitigation
To reduce the attack surface, restrict network access to the `cyrus-imapd` service to trusted clients or internal networks using firewall rules. For example, using `firewalld`: `sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_NETWORK>" port port="imap" protocol="tcp" accept'` `sudo firewall-cmd --reload` This may impact legitimate users who require remote access to the IMAP service. A service restart may be required for changes to take full effect.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
2 other sources (MITRE, Red Hat) ▾
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
NoTechnical Impact
PartialDecision
n/aAssessed Sep 10, 2026 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.
Score over time
Sep–Oct 2026- EPSS v5
Percentile over time
- EPSS v5
Table of values (2 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 3, 2026 | 0.22% (0.00224) | 11.88th | v5 (v2026.06.15) |
| Sep 10, 2026 | 0.21% (0.00205) | 10.55th | v5 (v2026.06.15) |
References (8)
- https://access.redhat.com/security/cve/CVE-2026-61908 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2526304 Issue Tracking
- https://cyrusimap.org Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-61908
- https://www.cve.org/CVERecord?id=CVE-2026-61908
- https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html Release Notes
- https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html Release Notes
- https://www.cyrusimap.org/3.12/imap/download/release-notes/3.8/x/3.8.8.html Release Notes
Change history (0)
No recorded changes yet.