CVE-2026-40013 Memory corruption in OX Dovecot CE
Authenticated attackers can cause memory corruption and denial of service, potentially leading to remote code execution, via malicious Sieve scripts in Dovecot.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40013?
CVE-2026-40013 is a medium-severity memory corruption vulnerability in Open-Xchange GmbH OX Dovecot CE, published on 28 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script. This causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of service for script management. This might be able to be used for remote code execution. Disable the ManageSieve service if users do not need remote Sieve script management. Update to non-vulnerable version. No publicly available exploits are known.
Weakness: CWE-124
Which versions are affected by CVE-2026-40013?
How do I fix CVE-2026-40013?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-40013 being exploited?
There is no known exploitation of CVE-2026-40013 in the wild and no public exploit code.
Sources
Also known as AZL-98268, DEBIAN-CVE-2026-40013, GHSA-jh33-8ccj-9h78, UBUNTU-CVE-2026-40013.