An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing

Versions reported by the vendor

Affected version ranges reported by the assigning authority (OX). Independent of NVD's CPE analysis and usually ahead of it.

• Open-Xchange GmbH OX Dovecot CE

  • 2.3.0 and later · before 2.4.5affected · semver

• Open-Xchange GmbH OX Dovecot Pro

  • 2.3.0 and later · before 2.3.22.2affected · semver
  • 3.0.0 and later · before 3.0.7affected · semver
  • 3.1.0 and later · before 3.1.6affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-42391An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CP
  30Monitor
• CVE-2026-33605An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating.
  30Monitor
• CVE-2026-27852An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters
  30Monitor
• CVE-2024-23185Very large headers can cause resource exhaustion when parsing message.
  30Monitor
• CVE-2026-73208An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a s
  29Monitor
• CVE-2026-40018None None None No publicly available exploits are known.
  29Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.