CVE-2026-47088: Low severity Cyrus cyrus-imapd vulnerability
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could craft an email message containing an RFC 822 comment ending with a backslash. When parsing the message, the server would read past the message's end in memory, and read into the heap, returning the read content to the user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47088?
The severity of CVE-2026-47088 is rated as low with a score of 3.1.
How do I fix CVE-2026-47088?
To fix CVE-2026-47088, update to the latest version of Cyrus IMAP that addresses the vulnerability.
Who is affected by CVE-2026-47088?
CVE-2026-47088 affects authenticated IMAP users of Cyrus IMAP versions up to 3.12.2.
What is the potential impact of CVE-2026-47088?
The potential impact of CVE-2026-47088 includes heap exposure due to nested MIME comment parsing.
Is CVE-2026-47088 an exploitable vulnerability?
CVE-2026-47088 could be exploited by a malicious authenticated user crafting a specific email message.