CVE-2026-61908

Summary

An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H<emailid>-<index>, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.

Affected Software

VendorProductVersion RangeStatus
cyrusimapCyrus IMAP0 < 3.8.8affected
cyrusimapCyrus IMAP3.9.0 < 3.10.4affected
cyrusimapCyrus IMAP3.11.0 < 3.12.4affected

Weaknesses

  • CWE-125: CWE-125 Out-of-bounds Read

References