CVE-2026-47088 describes a heap buffer over-read vulnerability (CWE-126) in the Cyrus IMAP server up to version 3.12.2. The flaw occurs when parsing nested MIME comments in email messages crafted by an authenticated IMAP user. Specifically, if an RFC 822 comment ends with a backslash, the parser reads past the end of the message buffer into heap memory, potentially exposing sensitive data from the heap to the attacker. The vulnerability requires network access, low privileges (authenticated user), and has high attack complexity. No integrity or availability impact is indicated.

The vulnerability allows an authenticated IMAP user to read memory beyond the intended message buffer, potentially exposing sensitive heap data. The confidentiality impact is limited (low), with no impact on integrity or availability. Exploitation requires authentication and crafting a specially formatted email message. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user capabilities as appropriate and monitor for suspicious email message formats. No official fix or workaround has been published at this time.