CVE-2026-40013
Medium · 4.3CVSS
4.3
EPSS
0.9%
Published
Aug 28, 2026
CISA due date
—
The record
An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script. This causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of service for script management. This might be able to be used for remote code execution. Disable the ManageSieve service if users do not need remote Sieve script management. Update to non-vulnerable version. No publicly available exploits are known.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-109964 ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability… CWE-124
- CVE-2026-73075 Vim is an open source, command line text editor. CWE-124
- CVE-2026-44631 Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in… CWE-124
- CVE-2024-36343 Improper input validation in the System Management Mode (SMM) communications buffer could… CWE-124
- CVE-2026-34253 A buffer underflow vulnerability has been identified in the ogg123 utility from the… CWE-124
- CVE-2026-5089 YAML::Syck versions before 1.38 for Perl has an out-of-bounds read. CWE-124
- CVE-2026-41499 Wazuh is a free and open source platform used for threat prevention, detection, and… CWE-124
- CVE-2026-26204 Wazuh is a free and open source platform used for threat prevention, detection, and… CWE-124