What is CVE-2026-61915?

CVE-2026-61915 is a medium-severity vulnerability in Cyrusimap Cyrus Imap, classified under Double Free. CVSS score: 4.2/10. Published 2026-09-09.

How severe is CVE-2026-61915?

Medium severity. CVSS v3 base score is 4.2 out of 10.

Double Free in Cyrusimap Cyrus Imap

CVE-2026-61915

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties.

Vulnerability class: Double Free

CVSS v3 metric

CVSS v3 base score 4.2 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L.

Affected products

Cyrusimap Cyrus Imap

Weakness classification (CWE)

CWE-415 — Double Free

References

cve@mitre.org
cve@mitre.org
cve@mitre.org
cve@mitre.org

Frequently asked questions

What is CVE-2026-61915?: CVE-2026-61915 is a medium-severity vulnerability in Cyrusimap Cyrus Imap, classified under Double Free. CVSS score: 4.2/10. Published 2026-09-09.
How severe is CVE-2026-61915?: Medium severity. CVSS v3 base score is 4.2 out of 10.