OX Dovecot Pro CVE-2026-42392

Exploitation requires valid IMAP credentials - the CVSS vector PR:L confirms low-privilege authenticated access is necessary; unauthenticated external attackers cannot exploit this vulnerability directly. The IMAP URLAUTH extension must be enabled on the server; the vendor's primary mitigation of disabling URLAUTH confirms this is a non-universal, configurable feature rather than a default-on component in all deployments. The attacker must have network access to the IMAP service (AV:N, AC:L). Exploitation is limited by the authentication prerequisite, making the realistic threat actors compromised accounts, malicious insiders, or shared-hosting tenants. The sensitivity of disclosed memory varies with server load and co-resident session state at the time of the request.

The CVSS 3.1 score of 4.3 (Medium) is consistent with the actual risk profile: the attack is network-accessible with low complexity and requires only low-privilege authenticated access, but impact is bounded to partial confidentiality loss with no integrity or availability consequence and no scope change. The vulnerability is not listed in CISA KEV, no public exploit code exists, and EPSS data is absent from available intelligence - all of which place this in a lower-urgency tier for most organizations. The realistic threat actor is an insider or a compromised mailbox account rather than an external unauthenticated attacker; the authentication gate substantially narrows the exposed surface. Shared IMAP hosting environments - where multiple tenants authenticate to the same Dovecot instance - face elevated risk, since memory from co-resident sessions could contain other tenants' data, creating a cross-tenant confidentiality concern that the raw CVSS score does not fully capture. The absence of confirmed fixed version numbers in the available CPE data (all version fields are wildcards) introduces scoping uncertainty that defenders should resolve via the vendor advisory before declaring remediation complete.

An attacker holding valid IMAP credentials - obtained via phishing, credential stuffing, or insider access - connects to the Dovecot IMAP server and issues a syntactically invalid URLFETCH command. The server's error handler constructs a response using an uninitialized buffer, returning raw process memory fragments to the attacker, who parses the response to extract potentially sensitive data such as authentication tokens or message content from other active sessions. No public exploit code is currently known, but the technique requires only standard IMAP protocol knowledge and a valid account.