Description

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-09-09T20:18:36.943Z",
  "pubdate": "2026-09-09T20:18:36.943Z",
  "executiveSummary": "A critical double-free vulnerability exists in Cyrus IMAP versions prior to 3.12.4 within the CalDAV component's VPATCH handling mechanism.\nThe flaw occurs during the processing of PATCH-ACTION attributes containing specific BYPARAM selectors when applied to resources possessing multiple properties of the same type.\nAn authenticated user can trigger this memory corruption, leading to a process crash of the Cyrus CalDAV worker.\nThis vulnerability poses a significant risk to service availability, as it allows a remote authenticated attacker to induce a denial-of-service (DoS) condition.\nNo special privileges beyond standard authentication are required to execute the exploit, making it accessible to any user with calendar access.",
  "technicalDetails": "The vulnerability resides in the VPATCH implementation within the Cyrus IMAP CalDAV subsystem. The root cause is a double-free memory management error triggered during the iteration over resource properties.\nWhen a user sends a PATCH request using the PATCH-ACTION='BYPARAM@...' syntax, the CalDAV worker attempts to resolve the specified selector against the target resource's properties. If the resource contains two or more properties of the matched kind, the internal logic iterates through these properties to apply the patch.\nDuring this iteration, the memory allocated for the selector object is incorrectly freed during each individual property processing step. Because the pointer to the selector is not invalidated or re-initialized correctly after the initial deallocation, subsequent iterations attempt to free the same memory address again. This behavior violates memory safety invariants, leading to immediate heap corruption.\nThe exploitation flow begins with the attacker crafting a malicious CalDAV PATCH request targeting a resource they have access to. The attacker must ensure that the resource has been provisioned with multiple properties of the same type to satisfy the conditional logic required to trigger the redundant free operation.\nUpon receipt of the request, the CalDAV worker process enters the vulnerable code path. The application repeatedly invokes the free() operation on the selector memory pointer. This results in undefined behavior within the heap allocator, typically resulting in an abort() or a segmentation fault that crashes the worker process.\nThe vulnerability is limited to authenticated users; however, in environments where calendar services are exposed to external users, this constitutes a significant denial-of-service vector. The post-exploitation impact is primarily limited to process-level instability. While double-free vulnerabilities can occasionally be weaponized for remote code execution (RCE) in complex heap manipulation scenarios, the primary observed impact in this specific Cyrus IMAP implementation is the termination of the affected worker service.\nAll Cyrus IMAP versions prior to 3.12.4 are considered vulnerable. The issue specifically pertains to the logic responsible for parsing and applying VPATCH actions within the CalDAV protocol handling routines."
}