{"id":"CVE-2026-61908","aliases":["DEBIAN-CVE-2026-61908","EUVD-2026-75134","GHSA-2x93-wv63-897r","UBUNTU-CVE-2026-61908","openSUSE-SU-2026:21929-1"],"status":"published","title":"An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an...","description":"An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H\u003cemailid\u003e-\u003cindex\u003e, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.","severity":{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.00224,"percentile":0.13136,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-09-09T00:00:00Z","modified":"2026-10-28T02:31:04Z","fixes":[{"ecosystem":"Debian:14","package":"cyrus-imapd","fixed_in":["3.12.4-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.0-1","3.10.0~beta1-1","3.10.0~beta1-2","3.10.0~beta1-3","3.10.0~beta2-1","3.10.0~rc2-1","3.10.1-1","3.10.1-2","3.10.1-3","3.10.1-3~bpo12+1","3.10.2-1","3.10.2-1~bpo12+1","3.12.0-1","3.12.0-2","3.12.1-1","3.12.1-2","3.12.1-3","3.12.2-1","3.12.3-1","3.12.3-1~bpo13+1","3.12.3-2","3.12.3-3","3.12.3-4","3.12.4-1","3.6.1-4","3.6.1-4+deb12u1","3.6.1-4+deb12u2","3.6.1-4+deb12u3","3.6.1-4+deb12u4","3.6.1-4+deb12u5","3.8.0-1","3.8.0-2","3.8.0-3","3.8.0-4","3.8.0-5","3.8.0~beta1-1","3.8.0~beta2-1","3.8.0~rc1-1","3.8.1-1","3.8.1-1~bpo12+1","3.8.1-2","3.8.1-3","3.8.2-1","3.8.3-1","3.8.4-1"]},{"source":"osv","ecosystem":"Debian:13","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.2-1","3.10.2-1+deb13u1","3.10.2-1+deb13u2","3.12.0-1","3.12.0-2","3.12.1-1","3.12.1-2","3.12.1-3","3.12.2-1","3.12.3-1","3.12.3-1~bpo13+1","3.12.3-2","3.12.3-3","3.12.3-4","3.12.4-1"]},{"source":"osv","ecosystem":"Debian:14","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.4-1"}]}],"versions":["3.10.2-1","3.12.0-1","3.12.0-2","3.12.1-1","3.12.1-2","3.12.1-3","3.12.2-1","3.12.3-1","3.12.3-1~bpo13+1","3.12.3-2","3.12.3-3","3.12.3-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.10-3build1","2.5.10-3build2","2.5.10-3ubuntu1","2.5.10-3ubuntu1.1","2.5.10-3ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.11-1","3.0.11-1build1","3.0.12-1","3.0.12-2","3.0.12-2ubuntu2","3.0.12-2ubuntu3","3.0.13-2ubuntu1","3.0.13-3ubuntu1","3.0.13-4ubuntu1","3.0.13-5","3.0.13-5ubuntu0.1~esm1","3.0.13-5ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.6-2build1","3.4.2-2","3.4.2-2build1","3.4.3-2","3.4.3-3","3.4.3-3build2","3.4.3-3ubuntu0.1","3.4.3-3ubuntu0.1+esm1","3.4.3-3ubuntu0.3","3.4.3-3ubuntu0.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.0-5","3.8.1-1","3.8.1-1build1","3.8.1-1build2","3.8.1-3","3.8.1-3build3","3.8.2-1","3.8.2-1ubuntu0.1~esm1","3.8.2-1ubuntu0.2","3.8.2-1ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.12.1-3","3.12.2-1","3.12.2-1build1","3.12.3-3build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.2-1","3.12.1-2","3.12.1-2build1","3.12.1-3"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.8-bp160.1.1"}]}],"bundled":6}],"products":[{"vendor":"cyrus","product":"imap"},{"vendor":"cyrusimap","product":"cyrus imap"}],"references":[{"url":"https://cyrusimap.org","tags":["Product","web"]},{"url":"https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.4.html","tags":["Release Notes","web"]},{"url":"https://www.cyrusimap.org/3.12/imap/download/release-notes/3.10/x/3.10.4.html","tags":["Release Notes","web"]},{"url":"https://www.cyrusimap.org/3.12/imap/download/release-notes/3.8/x/3.8.8.html","tags":["Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61908","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2x93-wv63-897r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61908.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-61908","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-61908","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-61908","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1279908","tags":["report"]},{"url":"https://bugzilla.suse.com/1279975","tags":["report"]},{"url":"https://bugzilla.suse.com/1279976","tags":["report"]},{"url":"https://bugzilla.suse.com/1279977","tags":["report"]},{"url":"https://bugzilla.suse.com/1279978","tags":["report"]},{"url":"https://bugzilla.suse.com/1279979","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61915","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-61908","description":"An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H\u003cemailid\u003e-\u003cindex\u003e, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.","status":"published","published":"2026-09-09T00:00:00Z","modified":"2026-09-10T18:59:01.259Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:19:53.4444Z"}],"euvd":[{"id":"EUVD-2026-75134","description":"An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H\u003cemailid\u003e-\u003cindex\u003e, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.","status":"published","published":"2026-09-09T00:00:00Z","modified":"2026-09-10T18:59:01Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T17:28:23.364345Z"}],"ghsa":[{"id":"GHSA-2x93-wv63-897r","title":"An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an...","description":"An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H\u003cemailid\u003e-\u003cindex\u003e, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.","status":"published","published":"2026-09-09T21:31:56Z","modified":"2026-09-09T21:32:03Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:11:40.819612Z"}],"nvd":[{"id":"CVE-2026-61908","description":"An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H\u003cemailid\u003e-\u003cindex\u003e, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.","status":"published","published":"2026-09-09T20:18:36.383Z","modified":"2026-09-16T15:24:33.31Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:12:45.93749Z"}],"osv":[{"id":"CVE-2026-61908","description":"An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H\u003cemailid\u003e-\u003cindex\u003e, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.","status":"published","published":"2026-09-09T00:00:00Z","modified":"2026-10-28T02:31:04.559421524Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:45:12.933503Z"},{"id":"DEBIAN-CVE-2026-61908","description":"An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H\u003cemailid\u003e-\u003cindex\u003e, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.","status":"published","published":"2026-09-09T20:18:36.383Z","modified":"2026-10-01T03:03:28.893742895Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"UBUNTU-CVE-2026-61908","description":"An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H\u003cemailid\u003e-\u003cindex\u003e, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.","status":"published","published":"2026-09-09T14:00:00Z","modified":"2026-10-17T12:59:15.701541911Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:43.630667Z"},{"id":"openSUSE-SU-2026:21929-1","title":"Security update for cyrus-imapd","description":"This update for cyrus-imapd fixes the following issues:\n\nChanges in cyrus-imapd:\n\nUpdate to 3.8.8 (bugfix release):\n\n- CVE-2026-61907: JMAP snooze bypasses destination-mailbox ACL (bsc#1279908)\n- CVE-2026-61908: JMAP email-header blob ID out-of-bounds index (bsc#1279975)\n- CVE-2026-61909: CalDAV/CardDAV multiget bypasses per-href ACL (bsc#1279976)\n- CVE-2026-61910: Mailbox/set let sharee change special-use role on shared mailboxes (bsc#1279977)\n- CVE-2026-61911: Sieve mailbox existence oracle (bsc#1279978)\n- CVE-2026-61915: VPATCH BYPARAM double-free (bsc#1279979)\n","status":"published","published":"2026-09-22T15:42:33Z","modified":"2026-09-25T18:23:14.142636484Z","updated_at":"2026-11-02T16:58:42.426393Z"}]}}