Search: CVE-2026-61908

CVE-2026-61908 is a low-severity out-of-bounds read vulnerability in Cyrus IMAP before version 3.12.4. It is triggered by a crafted JMAP email-header blob ID that causes the software to read beyond the end of an internal array, potentially exposing adjacent heap memory. The vulnerability requires an authenticated user and has high attack complexity. No user interaction is needed, and no known exploits are reported in the wild.