CVE-2026-61915

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties.

Scoring

Severity

MEDIUM

CVSS base score

4.2

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

CWE

CWE-415

Published

2026-09-09

Last modified

2026-09-09

Affected products

• cyrusimap Cyrus IMAP
• cyrusimap Cyrus IMAP
• cyrusimap Cyrus IMAP

Weakness type

• CWE-415

Related vulnerabilities

• CVE-2026-87585 — Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote...
• CVE-2026-79907 — Acrobat Reader | Double Free (CWE-415)
• CVE-2026-81950 — Microsoft Excel Remote Code Execution Vulnerability
• CVE-2026-80080 — Microsoft Office Word Remote Code Execution Vulnerability
• CVE-2026-69309 — Windows Print Spooler Components Elevation of Privilege Vulnerability
• CVE-2026-70567 — Windows Display Enhancement Service Elevation of Privilege Vulnerability
• CVE-2026-69725 — Windows Hello Elevation of Privilege Vulnerability
• CVE-2026-69876 — Windows DHCP Server Remote Code Execution Vulnerability

Markdown version · Browse all CVEs