OX Dovecot CVE-2026-40013

The ManageSieve service must be enabled and network-accessible - ManageSieve is not enabled by default in all Dovecot deployments and must be explicitly configured. An attacker must possess valid ManageSieve credentials (a legitimate email account or stolen credentials), matching the CVSS PR:L designation. No additional special configuration beyond ManageSieve being active is required: the crash is triggered during script compilation, which is a standard ManageSieve operation any authenticated user can invoke. Exploitation is limited by the authentication barrier - unauthenticated attackers cannot reach the vulnerable code path. Additionally, the scope of impact is bounded to the ManageSieve subsystem; core IMAP mail delivery continues unaffected after a ManageSieve process crash.

The official CVSS 3.1 score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L reflects network-reachable, low-complexity exploitation requiring only low-privilege credentials, but assigns only A:L (low availability impact). This appears conservative: a full process crash of ManageSieve results in complete loss of that service's availability until restarted, which this analyst assesses as A:H rather than A:L. No EPSS data was provided, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV and no public exploits are known, significantly lowering real-world urgency. The speculative RCE potential is a concern - memory corruption primitives can sometimes be escalated - but the vendor explicitly hedges with 'might be able to be used,' and the CVSS vector assigns C:N/I:N, indicating no confirmed code execution path has been validated. The primary real-world risk is targeted DoS against organizations relying on ManageSieve for user-managed email filtering, with low-privilege credentials already in hand. SSVC inference: exploitation is not demonstrated (low exploitation status), the attack is automatable given a credential, and the technical impact is partial (service crash without confirmed code execution).

An attacker with valid ManageSieve credentials - for example, a compromised or malicious email account holder - connects to the ManageSieve service and submits a Sieve script containing an extreme numeric literal value such as an integer near the 64-bit boundary. The Dovecot Sieve compiler attempts to process the literal and performs an out-of-bounds write, corrupting heap or stack memory and crashing the ManageSieve process. All users on the server are immediately denied remote Sieve script management until the process is manually restarted. No public exploit code exists at time of analysis, and the theoretical RCE path has not been demonstrated.