Description

An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H<emailid>-<index>, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-09-09T20:18:36.383Z",
  "pubdate": "2026-09-09T20:18:36.383Z",
  "executiveSummary": "This vulnerability is an out-of-bounds (OOB) heap memory read flaw affecting Cyrus IMAP versions prior to 3.12.4.\nThe issue stems from insufficient input validation when processing JMAP email-header blob IDs.\nAn authenticated attacker can trigger this vulnerability by requesting a specially crafted JMAP blob ID, allowing them to read data from memory adjacent to the internal blob_headers array.\nThe vulnerability poses a significant risk to data confidentiality, as sensitive information residing in the heap may be exposed to the attacker.\nSuccessful exploitation requires the attacker to be authenticated to the Cyrus IMAP service.\nNo specific privilege escalation is required beyond basic authentication, making this a high-priority concern for mail server environments.\nThe exposure of heap memory can facilitate further attacks by leaking pointers or sensitive user data, potentially undermining other security controls.",
  "technicalDetails": "The vulnerability resides within the JMAP (JSON Meta Application Protocol) handling implementation of Cyrus IMAP. Specifically, it involves the mechanism used to retrieve email header blobs via the blob ID system.\nThe root cause is an improper bounds check when parsing a JMAP blob ID formatted as 'H<emailid>-<index>'. The application fails to verify that the provided <index> value is within the valid range of the internal blob_headers array before accessing the memory location associated with that index.\nWhen an authenticated user requests a blob ID with a manipulated index value that exceeds the allocated size of the blob_headers array, the application attempts to read memory beyond the end of the array. This behavior results in an out-of-bounds memory read on the process heap.\nThe attack flow begins with an authenticated attacker submitting a JMAP request containing a crafted blob ID string. The server-side logic parses the index from this string and uses it as an offset into the blob_headers structure without first confirming that the offset is within the bounds of the array buffer. Consequently, the application reads memory residing at the out-of-bounds address and includes the contents of that heap memory in the response provided to the user.\nThis vulnerability allows an attacker to leak adjacent heap memory, which may contain sensitive data such as session tokens, user credentials, or other internal application state data. Because this occurs within the context of the Cyrus IMAP process, it directly threatens the confidentiality of the mail storage and processing environment.\nThe vulnerability is present in versions of Cyrus IMAP prior to 3.12.4. Mitigation requires ensuring that all index inputs are validated against the actual size of the array before any memory access occurs, preventing the process from reading unauthorized heap segments."
}