CVE-2026-42007

CVE-2026-42007 is a critical (CVSS 3.1: 9.1) use-after-free (CWE-416) in the Sieve editheader mail-editing code that runs during mail delivery, in the Sieve implementation of the Dovecot mail server maintained by Open-Xchange, which assigned the CVE. An attacker who already holds valid mail-account credentials can install or run a Sieve script using the editheader extension so that, while a message is being edited during delivery, memory is freed while still in use and contents beyond the intended buffer are written into the delivered email. This leaks residual memory contents into recipients' mail (reflected in the changed-scope, low confidentiality and integrity scores), can corrupt memory, crash the mail delivery process (high availability impact), and may allow arbitrary code execution in the context of that process. Any deployment running the affected Sieve implementation with the editheader extension enabled and allowing users to manage their own Sieve scripts is exposed; no specific vulnerable or fixed version numbers are stated in the available data. No public proof-of-concept or known in-the-wild exploitation exists (EPSS about 0.3%, not in CISA KEV), but internet-facing mail providers that expose account credentials and permit user-managed filtering are the most plausible targets.

What to do: Upgrade all mail servers running the affected Sieve implementation to the vendor's fixed (non-vulnerable) release cited in the Open-Xchange/Dovecot advisory, since no fixed version numbers are given in this data. As an interim mitigation, disable the Sieve editheader extension as recommended in the advisory and restrict which users can create or modify Sieve scripts. Check delivery logs for delivery-process crashes and delivered messages containing unexpected binary or memory-like content as indicators of attempted exploitation.