CVE-2026-42007: Use After Free in Open-Xchange GmbH OX Dovecot Pro

This vulnerability involves a use-after-free condition triggered by a Sieve script using the editheader extension in OX Dovecot Pro. The flaw allows an attacker with valid credentials to write beyond the intended buffer in the mail delivery process, causing memory leaks and corruption. This can result in process crashes and may enable arbitrary code execution within the mail delivery context. The vulnerability affects specific versions of OX Dovecot Pro and can be mitigated by disabling the editheader extension or updating to a fixed version.

Successful exploitation can lead to memory corruption, causing the mail delivery process to crash and potentially allowing arbitrary code execution with the privileges of that process. This poses a critical risk to the confidentiality, integrity, and availability of the mail delivery system.

Disabling the Sieve editheader extension prevents exploitation of this vulnerability. Additionally, updating to a non-vulnerable version of OX Dovecot Pro is recommended. Since no official patch or remediation level is provided in the vendor advisory, users should monitor vendor communications for updates.