OX Dovecot Pro CVE-2026-40015

Valid credentials for the targeted mail server are required - the CVSS PR:L metric confirms exploitation is not possible unauthenticated. The imap-hibernate service must be enabled on the server; deployments where IMAP hibernation is explicitly disabled are not affected by this specific code path. The crash is intermittent rather than deterministic on each attempt, indicating a timing- or load-dependent trigger that requires sustaining multiple concurrent malformed-command connections to reliably reproduce. The impact crosses user boundaries within a shared server instance - sessions belonging to other authenticated users sharing the same imap-hibernate process are disrupted, making this a co-tenancy availability concern. Exploitation is bounded to the availability of the IMAP service and does not provide code execution or data access based on available data.

The CVSS 3.1 score of 4.3 Medium accurately captures the bounded impact: the attack is network-accessible with low complexity (AV:N/AC:L) but requires authenticated access (PR:L), and impact is limited to low availability (A:L) with no confidentiality or integrity effects. The primary real-world concern is a malicious or compromised account holder on a shared mail platform intentionally disrupting IMAP service for other tenants - a cross-user availability attack rather than data compromise. EPSS data was not provided; without it, exploitation probability cannot be quantified beyond the CVSS signals. The vulnerability is not in CISA KEV and no public exploit code is identified, keeping real-world exploitation risk low to moderate. The 'Information Disclosure' tag in the intelligence metadata conflicts with the C:N CVSS metric - this may reflect theoretical CWE-125 memory disclosure potential rather than confirmed data leakage; defenders should not treat information disclosure as a confirmed impact without vendor clarification. Specific affected version ranges are not enumerated in CPE wildcards, which limits precise patch targeting without consulting the advisory directly.

An attacker with a valid email account on a shared Dovecot mail platform opens a large number of simultaneous connections to the imap-hibernate service endpoint and repeatedly sends syntactically invalid IMAP commands, driving the service into the load-sensitive out-of-bounds read condition. When the crash occurs, the imap-hibernate process terminates, severing hibernated sessions for other users on the same process instance and causing IMAP connectivity failures for co-tenants. No public exploit code exists, but the attack requires only the ability to script concurrent socket connections with malformed payloads - a low technical bar for any authenticated user.