CVE-2026-40013: Medium severity vulnerability
An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script. This causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of service for script management. This might be able to be used for remote code execution. Disable the ManageSieve service if users do not need remote Sieve script management. Update to non-vulnerable version. No publicly available exploits are known.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the ManageSieve service if users do not need remote Sieve script management.
ManageSieve service service enablement = disabled
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs valid credentials and access to the ManageSieve service. The issue is remotely reachable, but it does not affect unauthenticated attackers based on the available information.
What is the likely operational impact?
Submitting a crafted Sieve script can corrupt memory and crash the ManageSieve process, causing denial of service for remote Sieve script management. The advisory notes that remote code execution might be possible, but no public exploits are known.
What can be done if an update cannot be applied immediately?
Disable the ManageSieve service if users do not require remote Sieve script management. This removes the exposed service while an update to a non-vulnerable version is planned.