CVE-2025-15366 is a command injection vulnerability in the imaplib module of the Python standard library. The module fails to reject control characters like newlines in user-controlled input passed to IMAP commands, allowing injection of additional commands executed by the IMAP server. Exploitation requires privileges to send IMAP commands. The vulnerability can lead to unauthorized mailbox manipulation and limited data disclosure but does not allow arbitrary code execution. Red Hat published an advisory and updated python3 packages in Hardened Images RPMs to fix this issue.

An attacker with the ability to send IMAP commands can inject additional commands to manipulate mailbox state, including deleting emails, moving folders, flagging messages, and potentially reading metadata or specific email content. There is no arbitrary code execution or OS command injection risk. The impact is rated moderate by Red Hat but classified as high severity in this advisory due to the potential mailbox manipulation.

Red Hat has released updated python3 packages in Hardened Images RPMs that address this vulnerability. Users should apply these updates as per Red Hat's advisory instructions. Additionally, ensure that no data passed to the imaplib module contains newline or carriage return characters to mitigate the vulnerability. Patch status is confirmed by Red Hat advisory; a fix is available.