CVE-2026-42007: Use After Free in Open-Xchange GmbH OX Dovecot Pro

This vulnerability involves a use-after-free condition triggered by a Sieve script using the editheader extension in OX Dovecot Pro. The flaw allows writing beyond the intended buffer in the mail delivery process, causing memory leaks and corruption. This can crash the delivery process and may enable arbitrary code execution within that process context. The vulnerability requires valid credentials and no user interaction. It affects versions 2.3.0, 3.0.0, and 3.1.0 of the product.

Successful exploitation can lead to memory corruption, causing the mail delivery process to crash and potentially allowing arbitrary code execution with the privileges of that process. This compromises confidentiality, integrity, and availability of the mail delivery service. The CVSS score of 9.1 reflects critical severity with network attack vector, low attack complexity, and privileges required.

Disabling the Sieve editheader extension prevents exploitation of this vulnerability. Additionally, updating to a non-vulnerable version of OX Dovecot Pro is recommended once available. No public exploits are known, so immediate disabling of the extension reduces risk until patching is performed.