CVE-2026-42392: Exposure of Sensitive Information to an Unauthorized Actor in Open-Xchange GmbH OX Dovecot Pro

In OX Dovecot Pro version 2.3.0, an authenticated attacker can send an invalid IMAP URLFETCH command that triggers the server to return error responses containing uninitialized memory. This results in exposure of process memory contents to the client, potentially leaking sensitive data. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information). No exploits are publicly available, and the recommended mitigation is to disable the IMAP URLAUTH feature and upgrade to a fixed version.

The vulnerability allows an attacker with valid credentials to obtain unintended information from server memory via error responses, potentially exposing sensitive data. There is no indication of integrity or availability impact. The CVSS score of 4.3 reflects a moderate confidentiality impact with low attack complexity and required privileges.

Disabling the IMAP URLAUTH functionality effectively mitigates the vulnerability. Additionally, updating to a non-vulnerable version of OX Dovecot Pro is recommended once available. Since no patch link or vendor advisory is provided, check the vendor's official channels for updates. No urgent action is required if IMAP URLAUTH is disabled.