Cyrus SASL EUVD-2026-94582

Exploitation requires the victim to be acting as a CLIENT that uses the Cyrus SASL DIGEST-MD5 SASL mechanism (or HTTP Digest) and to initiate an authentication handshake against a server the attacker controls or can intercept on-path. The specific trigger is a crafted challenge field (realm or nonce) containing special characters that grow longer once DIGEST-MD5 quoting/escaping is applied, defeating the buffer size computed before quoting. Limiting factors that reduce real-world risk: the client must actually use the legacy DIGEST-MD5 (or HTTP Digest) mechanism rather than a modern SASL mechanism; the attacker must own or MITM the server endpoint (not merely send unsolicited traffic); and the client must initiate the connection (UI:R), yielding high attack complexity.

This is a client-side denial-of-service risk rather than a server-side, widely-automatable threat. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R) correctly captures the core constraints: exploitation is network-reachable and needs no attacker credentials, but it requires high attack complexity (the attacker must control the server the client connects to, or hold an on-path/MITM position) and user/client interaction (the victim client must initiate a DIGEST-MD5 or HTTP Digest authentication handshake). The input C:H/I:H/A:H impact rating overstates the realistic outcome: the description explicitly says the heap out-of-bounds write most likely results in a crash of the client application, pointing to an availability impact; code execution from the attacker-controlled heap write is theoretically conceivable for a CWE-122 flaw but is not demonstrated here, so the confidentiality and integrity ratings should be treated as unverified worst-case assumptions, not confirmed capabilities. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. Net: a genuine bug worth patching on client/library update cycles, but the AC:H plus UI:R plus legacy-mechanism (DIGEST-MD5) combination makes it far lower real-world priority than its 7.5 base score suggests.

A user runs a Cyrus SASL client application (for example a mail or LDAP client, or an HTTP Digest client) that authenticates using the DIGEST-MD5 mechanism against an attacker-controlled or on-path server. The malicious server returns a challenge whose realm or nonce field contains special characters that expand when DIGEST-MD5 quoting/escaping is applied, overflowing the under-sized heap buffer in add_to_challenge() via strcat() and most likely crashing the client. No public exploit code was provided in the input.