CVE-2026-47088
Received Received - Intake

Heap Exposure in Cyrus IMAP MIME Comment Parsing

Publication date: 2026-07-16

Last updated on: 2026-07-16

Assigner: MITRE

Description
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could craft an email message containing an RFC 822 comment ending with a backslash. When parsing the message, the server would read past the message's end in memory, and read into the heap, returning the read content to the user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-16
Last Modified
2026-07-16
Generated
2026-07-16
AI Q&A
2026-07-16
EPSS Evaluated
N/A
NVD
CVE-2026-47088
EUVD
EUVD-2026-45011

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cyrus_imapd cyrus_imapd 3.12.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-126 The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Cyrus IMAP through 3.12.2 involves heap exposure during nested MIME comment parsing. An authenticated IMAP user can craft an email with an RFC 822 comment ending in a backslash. When the server processes this message, it reads past the message's end into the heap and returns the read content to the user.

Impact Analysis

An attacker with authenticated IMAP access could exploit this to read sensitive data from the server's heap memory. This may expose confidential information, user credentials, or other internal data not intended for disclosure.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations using affected Cyrus IMAP versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade cyrus-imapd to a version beyond 3.12.2 to address the heap exposure issue in nested MIME comment parsing. Apply patches or updates provided by the vendor as soon as they are available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47088. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart