CVE-2026-47088
cyrus-imapd: Cyrus IMAP: Information disclosure via heap exposure in MIME comment parsing
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · July 16, 2026
Updated · July 17, 2026
Description
A flaw was found in Cyrus IMAP (Internet Message Access Protocol) daemon, cyrus-imapd. An authenticated IMAP user could exploit a heap exposure vulnerability during nested Multipurpose Internet Mail Extensions (MIME) comment parsing. By crafting an email message with a specially formed RFC 822 comment, the server could be made to read beyond the message's boundary in memory, potentially disclosing sensitive heap content to the attacker.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 3.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-125 · Out-of-bounds Read