CVE-2026-61915
Medium
Description
An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties.
SeverityMedium
CVSS4.2
Exploit probability—
ProductCyrus Imap
PublishedSep 9, 2026
First seenSep 9, 2026
Weakness typeCWE-415CWE-415
How to fix
Update
- cyrus imap3.8.8, 3.10.4, 3.12.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cyrus imap | v < 3.8.8, 3.9.0 ≤ v < 3.10.4, 3.11.0 ≤ v < 3.12.4 | 3.8.8, 3.10.4, 3.12.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.