CVE-2026-61908

A flaw was found in cyrus-imapd. An authenticated user could exploit this vulnerability by attempting to download a specially crafted JMAP (JSON Meta Application Protocol) blob ID. This action could lead to reading beyond the intended memory boundary, potentially exposing sensitive information from adjacent heap memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To reduce the attack surface, restrict network access to the cyrus-imapd service to trusted clients or internal networks using firewall rules. For example, using firewalld: sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_NETWORK>" port port="imap" protocol="tcp" accept' sudo firewall-cmd --reload This may impact legitimate users who require remote access to the IMAP service. A service restart may be required for changes to take full effect.