CVE-2021-3657
A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large...
A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders, could cause several different buffer overflows, which could conceivably be exploited for remote code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders, could cause several different buffer overflows, which could conceivably be exploited for remote code execution.
- Record
CVE-2021-3657- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders, could cause several different buffer overflows, which could conceivably be exploited for remote code execution.
- Record
CVE-2021-3657- Weakness
- CWE-119
- Updated
- 2026-11-02
EUVDEUVD-2021-26952 No score
A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders, could cause several different buffer overflows, which could conceivably be exploited for remote code execution.
- Record
EUVD-2021-26952- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gq8r-4g7c-69vw
A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large...
A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders, could cause several different buffer overflows, which could conceivably be exploited for remote code execution.
- Record
GHSA-gq8r-4g7c-69vw- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-3657
A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders, could cause several different buffer overflows, which could conceivably be exploited for remote code execution.
- Record
ALPINE-CVE-2021-3657- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSV
A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders, could cause several different buffer overflows, which could conceivably be exploited for remote code execution.
- Record
CVE-2021-3657- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-3657
A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders, could cause several different buffer overflows, which could conceivably be exploited for remote code execution.
- Record
DEBIAN-CVE-2021-3657- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-3657
A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders, could cause several different buffer overflows, which could conceivably be exploited for remote code execution.
- Record
UBUNTU-CVE-2021-3657- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11779-1 No score
isync-1.4.4-1.1 on GA media
These are all security issues fixed in the isync-1.4.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11779-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
isyncAlpine:v3.15 |
before 1.4.4-r0 | 1.4.4-r0 |
isyncAlpine:v3.16 |
before 1.4.4-r0 | 1.4.4-r0 |
isyncAlpine:v3.17 |
before 1.4.4-r0 | 1.4.4-r0 |
isyncAlpine:v3.18 |
before 1.4.4-r0 | 1.4.4-r0 |
isyncAlpine:v3.19 |
before 1.4.4-r0 | 1.4.4-r0 |
isyncAlpine:v3.20 |
before 1.4.4-r0 | 1.4.4-r0 |
isyncAlpine:v3.21 |
before 1.4.4-r0 | 1.4.4-r0 |
isyncAlpine:v3.22 |
before 1.4.4-r0 | 1.4.4-r0 |
isyncAlpine:v3.23 |
before 1.4.4-r0 | 1.4.4-r0 |
isyncAlpine:v3.24 |
before 1.4.4-r0 | 1.4.4-r0 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
isyncDebian:12 |
before 1.4.4-1 | 1.4.4-1 |
isyncDebian:13 |
before 1.4.4-1 | 1.4.4-1 |
isyncDebian:14 |
before 1.4.4-1 | 1.4.4-1 |
isyncDebian:9 From an advisory covering 3 CVEs |
before 1.2.1-2+deb9u1, plus listed versions 1.2.1-2 |
1.2.1-2+deb9u1 |
isyncUbuntu:16.04:LTS |
All versions, plus listed versions 1.1.2-1 |
None known |
isyncUbuntu:18.04:LTS |
All versions, plus listed versions 1.2.1-21.3.0-11.3.0-1build11.3.0-1ubuntu0.18.04.0 |
None known |
isyncUbuntu:20.04:LTS |
All versions, plus listed versions 1.3.0-2 |
None known |
isyncUbuntu:22.04:LTS |
All versions, plus listed versions 1.3.0-2.21.4.3-11.4.4-11.4.4-31.4.4-3ubuntu0.22.04.1 |
None known |
isyncUbuntu:24.04:LTS |
All versions, plus listed versions 1.4.4-51.4.4-5build21.4.4-5build3 |
None known |
isyncUbuntu:25.10 |
All versions, plus listed versions 1.4.4-5build31.5.1-1ubuntu1 |
None known |
isyncUbuntu:26.10 |
All versions, plus listed versions 1.5.1-1ubuntu21.5.1-1ubuntu4 |
None known |
isyncUbuntu:26.04:LTS |
All versions, plus listed versions 1.5.1-1ubuntu11.5.1-1ubuntu2 |
None known |
isyncopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 1.4.4-1.1 | 1.4.4-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-3657 is a critical vulnerability (CVSS 9.8) in Debian Linux, published February 18, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.49%, the 89th percentile. Fixed in isync 1.4.4-r0.