CVE-2026-61908
mediumAn issue was discovered in Cyrus IMAP before 3.12.4.
Vendor / product: Cyrus — imap
An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H-, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.
CVSS
6.5
6.5 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-09-09 20:18
Modified: 2026-09-16 15:24
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-10-27 06:52 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
cyrus / imap <3.8.8, ≥3.9.0 <3.10.4, ≥3.11.0 <3.12.4
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://cyrusimap.org cve@mitre.org
- https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html cve@mitre.org
- https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html cve@mitre.org
- https://www.cyrusimap.org/3.12/imap/download/release-notes/3.8/x/3.8.8.html cve@mitre.org
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:52 UTC · record ↗