Skip to main content

Dovecot CVE-2026-42007

| EUVDEUVD-2026-67672 CRITICAL
Use After Free (CWE-416)
2026-08-28 OX GHSA-9h72-j5f4-5cpc
RCE Buffer Overflow Use After Free Memory Corruption Red Hat Ox Dovecot Pro Ox Dovecot Ce Open Xchange Gmbh
9.1
CVSS 3.1 · Vendor: OX
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Authenticate with valid mailbox credentials
  2. Delivery
    Upload Sieve script using editheader
  3. Exploit
    Trigger delivery through filter
  4. Execution
    Free-then-use in header editor
  5. Persist
    Leak heap memory / corrupt allocations
  6. Impact
    Crash delivery process or execute code

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires valid account credentials (CVSS PR:L) and the ability to install a Sieve script that uses the 'editheader' extension, which must be enabled in the Dovecot/Pigeonhole configuration - if editheader is not offered to users, the vulnerable path is unreachable. Exploitation is triggered during mail delivery through the affected Sieve filter, needs no victim interaction (UI:N), and is network-reachable (AV:N). The primary limiting factors are the authentication requirement and the dependency on the editheader extension being available to the attacker's account.
Impact

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H = 9.1) indicates a network-reachable, low-complexity flaw needing only low-privilege credentials, with a scope change reflecting that the delivery process runs in a different security context than the authenticated user. Availability impact is High (delivery-process crash / DoS) while confidentiality and integrity are rated Low (bounded memory leak into mail, header tampering). No EPSS score, KEV listing, or POC was provided, so real-world exploitation pressure is currently unproven - the 'may allow execution of arbitrary code' language is explicitly conditional, meaning RCE is plausible but not demonstrated. Net: this is a genuine high-priority patching target because it is remotely triggerable by any mailbox user and yields at minimum reliable DoS and memory disclosure, but the arbitrary-code-execution outcome is uncertain and no active exploitation is confirmed.
Exploit ScenarioDerived

An attacker with a valid mailbox account uploads a personal Sieve filter that uses the editheader extension to manipulate headers on incoming mail, then sends or receives a message that triggers the filter. The use-after-free fires inside the delivery process, leaking adjacent heap memory into the delivered message and crashing the LDA; with careful heap grooming the same primitive may be escalated toward code execution in the delivery process context. No public exploit is known, so this would require original exploit development.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 28, 2026

Use-after-free in the OX Dovecot Pro and Dovecot CE mail-editing code lets an authenticated user who can install a Sieve filter with the editheader extension corrupt memory during mail delivery, leaking out-of-bounds buffer contents into the delivered message and potentially crashing or executing code in the delivery process. The flaw is remotely reachable with low-privilege credentials (CVSS 9.1, scope-changed) and combines information disclosure with a denial-of-service and possible RCE. No public exploit is identified at time of analysis and it is not on CISA KEV, so risk is currently theoretical but severe.

RemediationAI

Patch available per vendor advisory (oxdc-adv-2026-0003): update to the non-vulnerable version referenced at https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json - the advisory does not state an exact fixed version string, so confirm the target build with Open-Xchange before deploying. As an immediate compensating control the vendor recommends disabling the Sieve editheader extension (remove 'editheader' from the sieve_extensions / sieve_global_extensions configuration and restart the delivery service); the trade-off is that legitimate Sieve scripts relying on header add/remove/replace will stop functioning. Where feasible, additionally restrict who can upload custom Sieve scripts to limit which authenticated users can reach the vulnerable code path.

Affected VersionsENISA

OX Dovecot Pro 2.3.0 <2.3.22.2
OX Dovecot Pro 3.1.0 <3.1.6
OX Dovecot Pro 3.0.0 <3.0.7
OX Dovecot CE 2.3.0 <2.4.5

Affected Packages

euvd ox_dovecot_ce fix: 2.4.5
euvd ox_dovecot_pro fix: 2.3.22.2, 3.0.7, 3.1.6

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Dovecot is one of the most widely used IMAP/POP3 servers, and OX (Open-Xchange) ships hardened commercial (ox_dovecot_pro) and community (ox_dovecot_ce) builds. The affected component is the Sieve mail-filtering engine, specifically the RFC 5293 'editheader' extension that allows Sieve scripts to add/remove/replace message headers during delivery via the Local Delivery Agent. The root cause is CWE-416 (Use After Free): the header-editing code frees a buffer and continues to reference it, causing memory beyond the intended buffer to be read and written into the outgoing mail. This class of bug is a classic path from heap manipulation to information leak and, if an attacker can groom allocations, to controlled memory corruption.

Know when Ox Dovecot Pro gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (OX) PRIMARY 9.1 CRITICAL
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
vuln.today AI 9.1 CRITICAL

Authenticated user (PR:L) remotely triggers a UAF (AV:N/AC:L); delivery process runs in separate context (S:C); reliable crash (A:H) with bounded leak/tamper (C:L/I:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE CRITICAL
Red Hat 9.1 HIGH

Primary rating from Vendor (OX).

CVSS VectorVendor: OX

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
High

Lifecycle Timeline

2
Patch available
Aug 28, 2026 - 13:17 EUVD
CVE Published
Aug 28, 2026 - 10:12 cve.org
CRITICAL 9.1

DescriptionCVE.org

An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during mail delivery, which can crash the delivery process and may allow execution of arbitrary code in the context of that process. Disable the Sieve editheader extension. Update to non-vulnerable version. No publicly available exploits are known.

Executive ViewAI

Why It Matters

OX Dovecot Pro and Dovecot CE mail servers are vulnerable to data theft and service disruption through Sieve email filter rules (CVE-2026-42007), where any authenticated user with filter privileges can extract sensitive email contents and crash the mail system. Organizations relying on these platforms face both immediate information disclosure risks and delivery failures, with no vendor patch currently available to mitigate exposure. The CVSS 9.1 severity and lack of remediation options require urgent containment measures to prevent unauthorized email access and business continuity impacts.

Business Impact: Severe
Compensating Controls

Disable Sieve editheader extension and user filter creation immediately; restrict filter configuration to trusted administrators. Monitor mail delivery logs for abnormal memory errors or crashes. Implement network-level access controls to limit authentication attempts to Sieve-enabled services. If mail filtering must remain enabled, isolate Dovecot services on segmented networks with restricted user access.

Threat Intelligence Overview

EPSS Score
0.3%
Top 79% exploitable
Prevalence
High
Dovecot is the most widely deployed IMAP server; OX commercial/CE builds common in enterprise mail
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
Very High
Technical Impact
Partial

Priority Score

46
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +46
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

More in Ox Dovecot Pro

View all
CVE-2026-27851 CRITICAL
9.1 May 12

Authentication-layer injection in OX Dovecot Pro (versions up to and including 2.4.3 and 3.1.4) arises from a flaw in th
CVE-2026-24031 HIGH
8.2 Mar 27

Authentication bypass and user enumeration in OX Dovecot Pro (versions up to and including 3.1.0 and the 2.4.x line up t
CVE-2026-27860 LOW POC
3.7 Mar 27

Open-Xchange Dovecot Pro contains an LDAP filter injection vulnerability in its authentication module that allows remote
CVE-2026-42391 HIGH
7.5 Aug 28

Denial of service in OX Dovecot Pro and OX Dovecot CE allows unauthenticated remote attackers to exhaust memory and CPU

CVE-2026-33605 HIGH
7.5 Aug 28

ManageSieve login process in OX Dovecot CE and Pro crashes on receipt of a small malformed pre-authentication command, e
CVE-2026-27852 HIGH
7.5 Aug 28

Memory exhaustion in OX Dovecot Pro and OX Dovecot CE allows any remote sender to deny IMAP service to a targeted user b
CVE-2025-59028 HIGH
7.5 Mar 27

Unauthenticated remote attackers can disrupt authentication on OX Dovecot Pro servers by sending malformed base64 SASL d
CVE-2025-59032 HIGH
7.5 Mar 27

OX Dovecot Pro ManageSieve service crashes when processing AUTHENTICATE commands with SASL initial responses using liter
CVE-2026-27858 HIGH
7.5 Mar 27

OX Dovecot Pro managesieve-login process crashes repeatedly due to memory exhaustion triggered by unauthenticated attack
CVE-2026-27857 HIGH
7.5 Mar 27

Remote memory-exhaustion denial of service in OX Dovecot Pro (versions up to and including 2.3.0) lets an unauthenticate
CVE-2026-40018 HIGH
7.4 Aug 28

SQL injection in Open-Xchange OX Dovecot Pro and OX Dovecot CE enables unauthenticated remote attackers, under high-comp
CVE-2026-73208 HIGH
7.4 Aug 28

OAuth2 token validation in OX Dovecot Pro and OX Dovecot CE contains a logic error that permits authentication bypass wh

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected

References

Advisories & patches
ADVISORY https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-42007 ADVISORY https://vuldb.com/vuln/396678

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy