What is the CVSS score of CVE-2026-47088?

CVE-2026-47088 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-47088?

Yes, a patch is available for CVE-2026-47088. Update the affected software to the latest version immediately.

Cyrus IMAP CVE-2026-47088

EUVD-2026-45011 LOW

Buffer Over-read (CWE-126)

2026-07-16 mitre

GHSA-f77j-qm5m-p6cw

Buffer Overflow Cyrus Imap Cyrusimap

3.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

Network-accessible IMAP service requires valid credentials (PR:L); reliable heap data extraction depends on non-deterministic heap layout (AC:H); impact is confidentiality-only partial disclosure with no integrity or availability consequence.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 16, 2026 - 20:48 EUVD

Analysis Generated

Jul 16, 2026 - 19:04 vuln.today

DescriptionCVE.org

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could craft an email message containing an RFC 822 comment ending with a backslash. When parsing the message, the server would read past the message's end in memory, and read into the heap, returning the read content to the user.

AnalysisAI

Heap over-read in Cyrus IMAP through version 3.12.2 enables authenticated IMAP users to leak server heap memory by submitting a crafted email containing an RFC 822 MIME comment whose final character is a backslash. During message parsing, the server reads past the end of the message buffer into adjacent heap memory and returns the exposed content to the requesting user, resulting in partial, non-deterministic heap disclosure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a fix is referenced in the Cyrus IMAP 3.12.3 release notes.

Technical ContextAI

Cyrus IMAP (cyrus-imapd), maintained under Carnegie Mellon University's Project Cyrus, is a widely self-hosted open-source IMAP/LMTP server. The vulnerability resides in the server's nested MIME comment parser for RFC 822 structured headers. CWE-126 (Buffer Over-read) identifies the root cause class: the parser encounters a backslash as the final character of an RFC 822 comment token and incorrectly interprets it as an escape sequence requiring a following character, advancing the read pointer past the legitimate end of the allocated message buffer into adjacent heap memory. The content read from that adjacent region is then returned to the requesting user. The affected CPE string cpe:2.3:a:cyrusimap:cyrus_imap:*:*:*:*:*:*:*:* encompasses all Cyrus IMAP releases up to and including 3.12.2.

RemediationAI

Upgrade to Cyrus IMAP version 3.12.3 or later, which addresses this vulnerability per the release notes at https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html. The full release index at https://www.cyrusimap.org/imap/download/release-notes/index.html should be consulted to confirm the latest stable release for the deployed branch. If immediate upgrade is not feasible, restrict IMAP access to only fully trusted, internally managed user accounts - this reduces the attacker pool and the realistic likelihood of malicious message submission. Disabling any guest or externally provisioned IMAP authentication is a targeted compensating control, though it does not eliminate the flaw for internal authenticated users. There is no known configuration flag or feature toggle that disables RFC 822 comment parsing without impacting standard IMAP message handling; only patching resolves the underlying root cause.