Description

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits are known.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-28T12:16:31.247Z",
  "pubdate": "2026-08-28T12:16:31.247Z",
  "executiveSummary": "A critical vulnerability exists in the IMAP service implementation related to the processing of compressed data payloads. The issue is classified as a resource exhaustion vulnerability, specifically resulting in stack exhaustion upon the submission of maliciously crafted data.\nSuccessful exploitation requires the attacker to possess valid credentials for the targeted IMAP service. Once authenticated, an attacker can transmit a specially crafted compressed stream that forces the affected process to consume excessive stack memory, ultimately leading to process termination.\nThe primary impact of this vulnerability is a Denial of Service (DoS) condition, resulting in service degradation or complete availability loss for the IMAP protocol. The vulnerability poses a risk to service continuity for systems relying on this protocol. There are currently no publicly known exploits targeting this flaw, although the technical requirements for exploitation are limited to valid user-level access.\nRemediation requires updating the affected software to the vendor-provided non-vulnerable version to prevent unauthorized service disruption.",
  "technicalDetails": "The vulnerability manifests during the decompression phase of the IMAP data handling routine. When the IMAP process receives compressed data, it utilizes an internal buffer or stack-based structure to expand the payload. If the provided data contains specific sequences or structures that induce uncontrolled recursion or excessive stack-frame allocation, the process exceeds the allocated thread stack size.\nThe attack flow initiates when an authenticated user sends a crafted request via the IMAP protocol containing compressed data. Upon receipt, the IMAP service triggers a parsing function responsible for data decompression. If the parser lacks sufficient bounds checking or fails to handle deeply nested or malformed compressed blocks, it initiates an unsustainable sequence of function calls or data allocations on the stack.\nThis stack exhaustion effectively triggers a memory violation, which forces the host operating system to terminate the IMAP process to preserve system stability. Because the process terminates abruptly, any active sessions are dropped, and incoming connections remain unserved, resulting in a localized Denial of Service.\nThe vulnerable component is the decompression engine within the IMAP service. The exploitation is constrained by the requirement for valid credentials, meaning the attacker must be a registered user of the system. However, since the attack operates at the protocol level, no specialized privileges beyond standard authentication are required. The network exposure is defined by the availability of the IMAP port (typically 143 or 993) to the attacker.\nPost-exploitation impact is limited to the unavailability of the IMAP service. While the vulnerability results in a crash, it does not inherently provide for arbitrary code execution based on the provided description; rather, it induces a crash state. The reliance on valid credentials serves as the primary barrier against remote, unauthenticated exploitation. Organizations must monitor for repeated service crashes or anomalies in log files associated with IMAP process termination following compressed data requests."
}