CVE-2026-61908 is an out-of-bounds read vulnerability (CWE-125) in Cyrus IMAP versions 3.9.0 and 3.11.0. The flaw occurs when an authenticated user attempts to download a specially crafted JMAP blob ID of the form H<emailid>-<index>. This crafted ID can cause the server to read beyond the bounds of the internal blob_headers array during the download process, potentially exposing adjacent heap memory contents. The vulnerability has a CVSS 3.1 base score of 3.1, indicating low severity, with network attack vector, high attack complexity, low privileges required, no user interaction, and limited confidentiality impact.

An authenticated user can exploit this vulnerability to read memory beyond the intended bounds of the blob_headers array. This may lead to limited disclosure of adjacent heap memory contents. There is no indication of integrity or availability impact. The low CVSS score reflects the limited confidentiality impact and the requirement for authentication and high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Users should monitor vendor communications for updates and consider restricting authenticated user permissions if feasible until a fix is available.