CVE-2026-75002 affects Roundcube Webmail versions prior to 1.6.18 and 1.7.x prior to 1.7.3. The vulnerability arises from mail search and LITERAL+ byte-count desynchronization, which can be exploited via IMAP command injection. This flaw can result in unauthorized information disclosure or privilege escalation. The vulnerability is categorized under CWE-77 (Improper Neutralization of Special Elements used in a Command).

Successful exploitation of this vulnerability could allow an attacker with low privileges to inject IMAP commands, potentially leading to unauthorized access to sensitive information or escalation of privileges within the Roundcube Webmail environment. The CVSS score of 7.1 indicates a high impact on confidentiality and integrity, with a low impact on availability.

A fix is available in Roundcube Webmail versions 1.6.18 and 1.7.3 and later. Users should upgrade to these or later versions to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying the official patches provided by the vendor. Patch status is confirmed by the version numbers in the description. No known exploits are reported in the wild at this time.