OX Dovecot CVE-2026-33606

Two specific conditions must both be met: first, the attacker must be an authenticated mail user with the ability to store content in a mailbox (CVSS PR:L confirms low-privilege authenticated access is sufficient); second, an administrator must actively invoke dsync using the stream protocol against that mailbox - for example, explicitly during a server-to-server migration or a replication sync operation (CVSS UI:R and AC:H confirm this dependency). Normal IMAP access and day-to-day Dovecot operation without dsync stream migrations are not vulnerable. Exploitation is further limited by the attacker's need to either anticipate the migration event or socially engineer an administrator into triggering one. The injected commands affect only mailbox state integrity on the destination; there is no path to confidentiality breach or remote code execution, and no impact on users or systems outside the migration scope.

The CVSS 3.1 score of 4.8 (Medium) is well-calibrated for this vulnerability. AC:H reflects that exploitation is contingent on an administrator specifically invoking dsync with the stream protocol - a deliberate and non-default administrative action - while UI:R captures the dependency on that admin-initiated trigger. The impact is purely integrity-based (I:H) on the destination mailbox server, with no confidentiality breach and no confirmed path to code execution. In the absence of EPSS data in the provided intelligence, exploitation probability must be inferred: no KEV listing, no public exploits, and a constrained attack surface all point to low opportunistic risk. An organization like an email hosting provider or even a mid-sized municipal IT team in opole running periodic mailbox migrations would be exposed only during those specific migration windows, not continuously. The primary realistic threat is a targeted insider who crafts malicious mailbox content specifically to tamper with migration outcomes - not broad opportunistic scanning. CVSS and description signals are fully consistent; no metric conflicts or discrepancies are observed.

An authenticated mail user deliberately stores a message whose body or metadata embeds sequences that match valid dsync stream protocol command syntax. When an administrator later runs dsync with the stream protocol to migrate or replicate that mailbox - a common operation during server transitions - the crafted content passes through the dsync parser and is executed as protocol commands on the destination, silently altering internal mailbox attributes such as flags, metadata, or special-use annotations. No public exploit code exists at the time of analysis, so a successful attacker would require working knowledge of the dsync stream protocol format.