The vulnerability resides in the zmmailboxdmgr launcher of Zimbra Collaboration Suite. The passwordless sudo interface allows the zimbra user to supply unrestricted JVM arguments. An attacker can register an OnOutOfMemoryError handler, cause heap exhaustion during startup, and have the command executed while the JVM is still running as root. The impact is that a local user with access to a Zimbra mailbox server can gain root privileges: arbitrary command execution as root on that host. The weakness is categorized as CWE-88, indicating improper access control for privileged operations.

Zimbra Collaboration Suite versions 10.1.16 and 10.1.21 are affected. All mailbox servers running these releases are at risk if the zimbra account is accessible to a malicious local user.

The CVSS score is 7.8, indicating a high severity vulnerability. EPSS data is not available, but the nature of the flaw requires local command execution on the mailbox server, meaning that anyone who can execute commands as the zimbra user can exploit it. The vulnerability is not listed in the CISA KEV catalog, but the combination of high severity, local exploitation prerequisites, and the ability to elevate privileges to root makes it a top priority for remediation.