CVE-2026-42007: Use After Free
An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process and may allow execution of arbitrary code in the context of that process. Disable the Sieve editheader extension. Update to non-vulnerable version. No publicly available exploits are known.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs valid credentials and the ability to use a Sieve script with the editheader extension. Exploitation occurs during mail delivery and may affect the delivery process context.
Is the vulnerable functionality enabled by default?
The available information does not state whether the Sieve editheader extension is enabled by default. Systems where that extension is disabled are not exposed through the described attack path.
What can be done before an update is available or can be applied?
Disable the Sieve editheader extension. This removes the extension required for the described exploit path.
What is the expected impact if exploitation succeeds?
The issue can leak memory contents into delivered mail, corrupt memory during mail delivery, and crash the delivery process. It may also permit arbitrary code execution in the context of that process.
Are public exploits available?
No publicly available exploits are known.