The vulnerability allows an authenticated IMAP user to craft an email containing an RFC 822 comment that ends with a backslash. While parsing the message, the Cyrus IMAP server erroneously reads past the message’s boundary into adjacent heap memory and returns that data to the user. This results in the disclosure of potentially sensitive information that was present in heap memory, which could include private data or system secrets.

Cyrus IMAP software versions up to and including 3.12.2 are affected. The fix is delivered in the 3.12.3 release and later versions.

The CVSS score is 3.1, indicating low overall severity. The EPSS score is below 1%, suggesting a very low probability of exploitation in the wild. The issue requires authentication to the IMAP service and the ability to send a specially crafted message; therefore, the attack vector is inferred to be remote via the IMAP protocol. Because the execution simply results in a data leak, it does not directly enable code execution or privilege escalation, but it could aid an adversary in gathering information for future attacks. The vulnerability is not listed in CISA KEV at present.