The vulnerability arises from a script provided by Dovecot for converting attachments to text, which unsafely processes zip-style attachments. An attacker can craft OOXML documents that cause files not intended for indexing to be processed and included in full-text search indexes, leading to exposure of sensitive information. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low complexity, requiring low privileges, no user interaction, and limited confidentiality impact. No official patch or fix is currently documented, and no exploits are known in the wild.

The impact is limited to unauthorized exposure of sensitive information due to unintended files being indexed and included in full-text search results. There is no impact on integrity or availability. The vulnerability requires an attacker with low privileges to supply a crafted OOXML document. No known exploitation has been reported.

Users should avoid using the provided attachment-to-text conversion script that handles zip-style attachments unsafely. Instead, alternative tools such as FTS tika should be used for attachment text extraction. Patch status is not confirmed; check vendor advisories for updates. No urgent patch is currently documented, and no exploits are known.