CVE-2026-42007: Critical Use-After-Free in Dovecot's Sieve Editheader Extension

Overview

A critical use-after-free vulnerability has been disclosed in Dovecot, one of the most widely deployed open-source IMAP and POP3 mail server implementations. Tracked as CVE-2026-42007, the flaw lives in the Pigeonhole Sieve editheader extension — the component that lets mail-filtering scripts add, delete, or replace message headers during delivery.

An attacker who holds valid mailbox credentials can upload or trigger a Sieve script that exploits the editheader extension to free a memory region and then continue writing to it, corrupting heap memory and writing content beyond the intended buffer into the message being delivered. Open-Xchange, which maintains the commercial Dovecot Pro line alongside the Community Edition, rates the issue 9.1 (Critical) and disclosed it as part of a 30-vulnerability advisory released August 26, 2026.

Technical Details

How It Works

Dovecot's Sieve interpreter supports the editheader extension, which is not enabled by default but is commonly turned on to let filtering scripts rewrite message headers on the fly (e.g., tagging, stripping, or normalizing headers before delivery). CVE-2026-42007 triggers a use-after-free in the mail-editing code path: a crafted Sieve script frees a buffer used to hold header data and then keeps referencing it, causing Dovecot to write attacker-influenced content past the buffer's original bounds and into the message being delivered.

Because the vulnerability has a Scope: Changed (S:C) designation in its CVSS vector, successful exploitation can impact components beyond the vulnerable Sieve process itself — consistent with memory corruption that propagates into the delivered mail data. The practical outcomes range from a crashed delivery agent (denial of service) to full memory corruption with a path toward arbitrary code execution during mail delivery.

Impact Assessment

Who Is at Risk

Any organization running a vulnerable OX Dovecot deployment with the editheader extension enabled is exposed, including:

• Managed email and hosting providers running multi-tenant Dovecot Pro clusters
• Enterprises self-hosting OX Dovecot Community Edition with custom Sieve filtering rules
• Any environment where mailbox users are permitted to upload their own Sieve scripts (a common self-service feature in webmail control panels)

Because exploitation requires only low-privilege, authenticated access — not administrative rights — any mailbox user, including a compromised low-value account, is a viable attack vector.

Attack Chain

1. Access — Attacker obtains or already holds valid credentials for a mailbox on a vulnerable server
2. Delivery — Attacker uploads a Sieve script using the editheader extension, or triggers processing of one, containing the crafted trigger
3. Corruption — The use-after-free fires during the next mail delivery processed by that script, corrupting heap memory
4. Escalation — Depending on heap layout and mitigations in place, corruption can crash the mail delivery process or be leveraged toward code execution in the delivery agent's context

Mitigation

Immediate Actions

• Update to a fixed release: OX Dovecot Pro 2.3.22.2, 3.0.7, or 3.1.6; OX Dovecot Community Edition 2.4.5
• Disable the editheader extension as an interim mitigation if patching cannot happen immediately — this fully closes the vulnerable code path
• Restrict Sieve script uploads (ManageSieve) to trusted administrators where self-service filtering isn't required
• Review this advisory alongside the other 29 vulnerabilities disclosed in the same batch (OXDC-ADV-2026-0003), several of which affect ManageSieve and IMAP components on the same vulnerable version ranges

Detection Opportunities

• Monitor Dovecot LMTP/LDA delivery logs for unexpected crashes or restarts of delivery worker processes
• Audit recently modified or uploaded Sieve scripts for unusual editheader usage patterns
• Watch for anomalous memory usage or core dumps from dovecot-lda, lmtp, or sieve-* processes

Defence-in-Depth

• Run mail delivery processes with the minimum privileges necessary and enable OS-level exploit mitigations (ASLR, stack canaries) if not already active
• Segment ManageSieve access behind authenticated, rate-limited endpoints
• Maintain an inventory of which mailboxes and domains have self-service Sieve filtering enabled, so remediation can be scoped quickly

Background

CVE-2026-42007 was one of 30 vulnerabilities patched in Open-Xchange's OXDC-ADV-2026-0003 advisory, spanning issues from low-severity information disclosure to this critical use-after-free. Dovecot and its Pigeonhole Sieve implementation underpin mail delivery for a large share of self-hosted and hosting-provider email infrastructure, making prompt patching of the Sieve subsystem a priority for any organization exposing ManageSieve or self-service filtering to end users.

References

• Open-Xchange Dovecot Security Advisories
• Dovecot Pigeonhole — Sieve Editheader Extension
• NVD — CVE-2026-42007