CVE-2026-42392: Infoleak
An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH functionality. Update to non-vulnerable version. No publicly available exploits are known.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs valid credentials and network access to submit an invalid IMAP URLFETCH command. No user interaction is required.
What is exposed if exploitation succeeds?
The server can include uninitialized process memory in an error response sent to the attacker. That memory may contain sensitive data.
What mitigation is available if an update cannot be applied immediately?
Disable IMAP URLAUTH functionality to prevent use of the affected URLFETCH command.
Are public exploits known?
No publicly available exploits are known.