CyberRota Analysis
AI-GeneratedCyrus IMAP versions prior to 3.12.4 are vulnerable to an out-of-bounds read due to improper handling of JMAP email-header blob IDs, which may allow authenticated users to access adjacent heap memory. While the severity is classified as low, this vulnerability could potentially expose sensitive information. Organizations using affected versions should prioritize patching to mitigate the risk of information disclosure.
Original NVD Description
An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H<emailid>-<index>, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.