OX Dovecot CVE-2026-27852

The attacker must be able to deliver email to the target user - no account on the Dovecot server is required, and standard SMTP relay access to the target domain is sufficient. Exploitation is triggered when the victim's IMAP process parses the malicious message, which occurs during any IMAP FETCH operation; many email clients perform this automatically on sync, reducing the practical dependency on explicit user action. The DoS is scoped to the individual user's IMAP worker process: other users on the same server are unaffected. No non-default configuration is required on the server side - the flaw exists in the default message parsing path. Exploitation is limited to availability impact only; no confidentiality or integrity compromise is possible via this vector.

The NVD-assigned CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields a 7.5 (High), which accurately reflects that no authentication or special configuration is required on the attacker side. However, the practical blast radius is per-user, not server-wide: the IMAP worker process for the targeted user is terminated rather than the entire mail service, so the Availability impact is scoped to a single mailbox session at a time. EPSS data was not provided in the source intelligence, and there is no KEV listing and no public exploit code, which meaningfully lowers real-world urgency below what the raw score implies. For large multi-tenant environments, repeated targeted sends against high-value accounts could sustain a disruptive campaign, but the absence of any persistent system compromise or privilege escalation keeps this in the operational-nuisance tier rather than the critical-response tier.

An attacker with the ability to deliver email to a target address - requiring no account on the victim server - sends a single crafted message with headers containing thousands of recipient addresses or MIME parameters. When the victim's IMAP client (or an automated IMAP sync process) fetches the message, the Dovecot IMAP worker process exhausts its memory allocation and is terminated, dropping the user's IMAP session. No public exploit code exists, but the technique requires only standard SMTP access and crafting an oversized header, placing it within reach of any motivated sender.