CVE-2026-61908: Cyrus IMAP Use-After-Free Vulnerability

CVE-2026-61908 Overview

CVE-2026-61908 is an out-of-bounds read vulnerability in Cyrus IMAP versions prior to 3.12.4. The flaw exists in the JSON Meta Application Protocol (JMAP) blob download handler, which processes email-header blob identifiers. An authenticated user can craft a JMAP blob ID in the form H<emailid>-<index> where the index value references memory outside the bounds of the internal blob_headers array. Reading past the array boundary exposes adjacent heap memory to the requester. The vulnerability is classified under [CWE-125] Out-of-Bounds Read.

Critical Impact
Authenticated attackers can leak adjacent heap memory contents through crafted JMAP blob download requests, potentially exposing sensitive server-side data.

Affected Products

Cyrus IMAP versions prior to 3.12.4
Cyrus IMAP versions prior to 3.10.4 (3.10.x branch)
Cyrus IMAP versions prior to 3.8.8 (3.8.x branch)

Discovery Timeline

2026-09-09 - CVE-2026-61908 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-61908

Vulnerability Analysis

The vulnerability resides in the Cyrus IMAP JMAP subsystem, which handles blob download operations for email content. JMAP blob identifiers use a structured format that includes a type prefix, an email identifier, and an index into an internal array. When the handler receives a blob ID prefixed with H (email-header blob), it parses the numeric <index> and uses that value to access the blob_headers array associated with the target email.

The handler does not validate the parsed index against the actual length of the blob_headers array. An authenticated user can supply an out-of-bounds index and force the server to read memory beyond the array's allocated region. The download operation returns that memory to the requester, disclosing adjacent heap contents.

Exploitation requires authenticated access to the JMAP endpoint and knowledge of a valid <emailid> on the target server. Successful attempts leak heap data that may include fragments of other messages, session state, or allocator metadata.

Root Cause

The root cause is missing bounds validation on the <index> component of the JMAP header blob identifier. The parser accepts any integer value and passes it directly to the array access without comparing it against the header count for the referenced email.

Attack Vector

The attack vector is network-based and requires authenticated JMAP access. An attacker issues a blob download request against H<emailid>-<index> where <index> exceeds the valid range of the blob_headers array for the referenced email. The server response contains data read from beyond the array boundary.

No verified exploit code is publicly available. See the Cyrus IMAP 3.12.4 release notes for maintainer-supplied technical details.

Detection Methods for CVE-2026-61908

Indicators of Compromise

JMAP blob download requests targeting identifiers matching the pattern H<emailid>-<index> with unusually large or negative index values.
Repeated Blob/get or blob download HTTP requests from a single authenticated session iterating through sequential index values.
Anomalous outbound response sizes for header blob downloads that do not correspond to expected header data.

Detection Strategies

Parse Cyrus IMAP JMAP access logs and flag blob identifiers where the numeric <index> component exceeds a reasonable threshold for message header counts.
Correlate authenticated JMAP sessions that perform bulk blob enumeration with account risk signals such as new geolocation or unusual client software.
Enable verbose logging on JMAP endpoints to capture full blob identifier values for post-incident forensic review.

Monitoring Recommendations

Monitor Cyrus IMAP process memory and error logs for unexpected reads or crashes originating in JMAP blob handlers.
Track authentication events that precede spikes in JMAP blob download volume from individual accounts.
Alert on Cyrus IMAP server versions that remain below 3.8.8, 3.10.4, or 3.12.4 in software inventory systems.

How to Mitigate CVE-2026-61908

Immediate Actions Required

Upgrade Cyrus IMAP to version 3.12.4, 3.10.4, or 3.8.8 depending on the deployed release branch.
Audit JMAP-enabled accounts and revoke credentials for any account showing suspicious blob download patterns.
Restrict JMAP endpoint exposure to trusted networks where operational requirements permit.

Patch Information

The Cyrus IMAP maintainers addressed CVE-2026-61908 in versions 3.12.4, 3.10.4, and 3.8.8. Refer to the Cyrus IMAP 3.12.4 release notes, the Cyrus IMAP 3.10.4 release notes, and the Cyrus IMAP 3.8.8 release notes for upgrade procedures and full change details.

Workarounds

Disable the JMAP protocol in imapd.conf on servers where JMAP is not required for client operations.
Enforce strict authentication policies and multi-factor authentication for JMAP-capable accounts to raise the barrier for authenticated exploitation.
Place Cyrus IMAP JMAP endpoints behind a reverse proxy that can inspect and reject blob identifiers containing out-of-range index values.

bash

# Example: disable JMAP in Cyrus imapd.conf until patching is complete
# /etc/imapd.conf
httpmodules: caldav carddav
# (Remove 'jmap' from the httpmodules list, then restart cyrus-imapd)
systemctl restart cyrus-imapd