Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-42007 |
| Alert Source | GitHub Advisory - Critical vulnerability |
| CVE Year | 2026 |
| Publication Date | 2026-08-28 |
| Vendor | Open-Xchange |
| Product | Dovecot (Pigeonhole / Sieve) |
| CVSS Score | 9.1 (Critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Source: NVD / Open-Xchange (oxdc-adv-2026-0003)
An attacker holding valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code and write memory contents beyond the intended buffer into the delivered message.
The impact is twofold:
- memory leak — fragments of the delivery process’s memory end up in the message body. That process handles mail for many users, so leaked data may come from someone else’s correspondence,
- memory corruption during delivery — this can crash the delivery process and may allow execution of arbitrary code in its context.
The credential requirement raises the bar less than it appears: in a mail environment, user credentials are obtained by phishing, and users can typically define Sieve scripts themselves through webmail. One compromised employee account is enough.
Required Actions
The vendor gives two paths:
- Disable the Sieve
editheaderextension — an immediate mitigation that needs no maintenance window. Verify first whether any user filters rely on it. - Update Dovecot to a non-vulnerable version per the Open-Xchange advisory.
The vendor notes no other mitigations are known — network restrictions do not help, because the attack originates from an authenticated user.
Who Is Affected?
The vulnerability affects Dovecot servers with Pigeonhole installed and the Sieve editheader extension enabled.
Dovecot is the most widely used IMAP server in the world and the backbone of most self-hosted mail deployments. That means hosting providers, operators, universities, public administration bodies and every organisation that has not moved mail to Microsoft 365 or Google Workspace — and, given data-residency requirements, there are still plenty of those in the public and financial sectors.
Sieve scripts are standard in such deployments, since they drive filtering rules and auto-replies. It is worth checking whether editheader is needed at all — it is sometimes enabled by default with no actual use.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
