CVE-2026-47088

Name of the Vulnerable Software and Affected Versions cyrus-imapd versions prior to 3.12.3

Description An issue exists in the parsing of nested MIME comments. An authenticated IMAP user can craft an email message containing an RFC 822 comment that ends with a backslash. This causes the server to read past the end of the message in memory and access the heap, subsequently returning the leaked heap content to the user.

Recommendations Update cyrus-imapd to version 3.12.3 or later.