CVE-2026-47088
Low · 3.1CVSS
3.1
EPSS
0.3%
Published
Jul 16, 2026
CISA due date
—
The record
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could craft an email message containing an RFC 822 comment ending with a backslash. When parsing the message, the server would read past the message's end in memory, and read into the heap, returning the read content to the user.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-93524 A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWayland before… CWE-126
- CVE-2026-57185 Asterisk is an open source private branch exchange and telephony toolkit. CWE-126
- CVE-2026-53920 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. CWE-126
- CVE-2026-55606 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. CWE-126
- CVE-2026-107928 When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory… CWE-126
- CVE-2026-112404 Pillow is a Python imaging library. CWE-126
- CVE-2026-112394 Pillow is a Python imaging library. CWE-126
- CVE-2026-85745 MariaDB server is a community developed fork of MySQL server. CWE-126