CVE-2026-42392

Deferred Deferred - Pending Action

IMAP URLFETCH Memory Disclosure in Open-Xchange

Publication date: 2026-08-28

Last updated on: 2026-09-03

Assigner: Open-Xchange

Description

An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH functionality. Update to non-vulnerable version. No publicly available exploits are known.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-03

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-42392

EUVD

EUVD-2026-67675

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability allows an attacker with valid credentials to send a malformed IMAP URLFETCH command. This causes uninitialized memory to be included in the error response sent back to the client. The uninitialized memory may contain sensitive data that is then disclosed to the attacker.

Detection Guidance

This vulnerability can be detected by monitoring IMAP server responses for invalid URLFETCH commands that include uninitialized memory. Check server logs for unusual error responses containing sensitive data. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to access sensitive data stored in memory, such as user credentials, personal information, or other confidential data. This could lead to further attacks or data breaches if the disclosed information is used maliciously.

Compliance Impact

This vulnerability could result in unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face compliance penalties or legal consequences if such breaches occur.

Mitigation Strategies

Disable the IMAP URLAUTH functionality on the affected system.
Update to a non-vulnerable version of the IMAP server software.

Hi! I’m here to help you understand CVE-2026-42392. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70