CVE-2026-61915EPSS p16.0%

CVE-2026-61915CVE-2026-61915

cyrus / imap

Description

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties.

Scoring

CVSS 4.2 ()
VectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
EPSS0.26% probability of exploitation · percentile 16.0% · 2026-10-05T12:00:23Z
Last modified2026-09-16
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.