CVE-2026-40013
Received Received - Intake

Memory Corruption in ManageSieve Service via Extreme Numeric Literal

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: Open-Xchange

Description
An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script. This causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of service for script management. This might be able to be used for remote code execution. Disable the ManageSieve service if users do not need remote Sieve script management. Update to non-vulnerable version. No publicly available exploits are known.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-28
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-40013
EUVD
EUVD-2026-67663

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
open-xchange managesieve *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-124 The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an attacker with valid credentials to submit a malicious Sieve script containing an extremely large numeric value. When the ManageSieve service processes this script, it causes an out-of-bounds memory write, leading to memory corruption and a crash of the ManageSieve process. This results in a denial of service for script management functionality.

Detection Guidance

Check if the ManageSieve service is running by using commands like 'systemctl status managesieve' or 'ps aux | grep managesieve'. Monitor for crashes of the ManageSieve process, which may indicate exploitation attempts.

Impact Analysis

If exploited, this vulnerability could disrupt the ManageSieve service, preventing users from managing their Sieve scripts remotely. In severe cases, it might allow remote code execution, potentially compromising the entire system. The impact is limited to the ManageSieve service unless the memory corruption leads to broader system compromise.

Mitigation Strategies

Disable the ManageSieve service if remote Sieve script management is not required. Update to a non-vulnerable version of the software as soon as possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-40013. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart