Dovecot EUVD-2026-67672

Requires valid account credentials (CVSS PR:L) and the ability to install a Sieve script that uses the 'editheader' extension, which must be enabled in the Dovecot/Pigeonhole configuration - if editheader is not offered to users, the vulnerable path is unreachable. Exploitation is triggered during mail delivery through the affected Sieve filter, needs no victim interaction (UI:N), and is network-reachable (AV:N). The primary limiting factors are the authentication requirement and the dependency on the editheader extension being available to the attacker's account.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H = 9.1) indicates a network-reachable, low-complexity flaw needing only low-privilege credentials, with a scope change reflecting that the delivery process runs in a different security context than the authenticated user. Availability impact is High (delivery-process crash / DoS) while confidentiality and integrity are rated Low (bounded memory leak into mail, header tampering). No EPSS score, KEV listing, or POC was provided, so real-world exploitation pressure is currently unproven - the 'may allow execution of arbitrary code' language is explicitly conditional, meaning RCE is plausible but not demonstrated. Net: this is a genuine high-priority patching target because it is remotely triggerable by any mailbox user and yields at minimum reliable DoS and memory disclosure, but the arbitrary-code-execution outcome is uncertain and no active exploitation is confirmed.

An attacker with a valid mailbox account uploads a personal Sieve filter that uses the editheader extension to manipulate headers on incoming mail, then sends or receives a message that triggers the filter. The use-after-free fires inside the delivery process, leaking adjacent heap memory into the delivered message and crashing the LDA; with careful heap grooming the same primitive may be escalated toward code execution in the delivery process context. No public exploit is known, so this would require original exploit development.