Cyrus IMAP EUVD-2026-45011

Exploitation requires a valid, authenticated IMAP account on the target Cyrus IMAP server (confirmed by CVSS PR:L). The attacker must be capable of submitting or causing the server to parse an email message containing a nested MIME structure with an RFC 822 comment whose final character is a backslash - this specific message construction is what triggers the over-read. No special server configuration, non-default feature, or particular deployment mode is required; the vulnerable code path is exercised during normal message parsing. What limits exploitation is the high attack complexity (CVSS AC:H): the heap bytes read beyond the buffer are determined by runtime memory layout at the moment of parsing, which the attacker cannot reliably control or predict. Extracting targeted, meaningful data therefore requires repeated attempts and favorable heap conditions that cannot be guaranteed. Deployments that allow only fully trusted, internal IMAP users significantly reduce realistic risk.

The NVD CVSS 3.1 base score of 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately characterizes this as a low-severity issue. Authentication is required - the CVSS PR:L metric confirms exploitation demands a valid IMAP account - which materially limits the attacker pool to users who already have legitimate server access. High attack complexity (AC:H) reflects the non-deterministic nature of heap layout: what data, if any, can be extracted depends on runtime memory state at parse time, making reliable targeting of sensitive heap contents difficult. No EPSS score was included in the provided intelligence data, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. No public proof-of-concept exploit has been identified. The scope is unchanged (S:U), with impact confined to partial confidentiality loss and no integrity or availability consequences. Real-world priority is low: the flaw requires a legitimate credential, a specially crafted message, and favorable heap conditions - none of which are trivially controlled by an attacker. Organizations with open IMAP registration or shared hosting environments face slightly elevated exposure relative to those with tightly controlled user rosters.

An authenticated IMAP user submits a crafted email message containing a nested MIME structure with an RFC 822 comment token whose final character is a backslash, causing the Cyrus IMAP parser to advance its read pointer past the message buffer boundary into adjacent heap memory. The server includes bytes from that adjacent heap region in its response to the user, potentially exposing residual data from prior server operations such as other users' session fragments, cached message data, or internal state. Because heap layout at parse time is non-deterministic, an attacker would likely need to send many crafted messages and analyze responses to attempt targeted data recovery, making reliable exploitation difficult.