CVE-2026-42007

Name of the Vulnerable Software and Affected Versions Email servers allowing Sieve scripts (affected versions not specified)

Description An attacker with valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free condition in the mail editing code. This allows writing memory contents beyond the intended buffer into the delivered mail, resulting in a memory leak and potential memory corruption during mail delivery. Such an issue can crash the delivery process and may lead to arbitrary code execution within the context of that process.

Recommendations Disable the Sieve editheader extension. Update to a non-vulnerable version.