CVE-2005-0546: Cyrus Imapd

High severity, CVSS 7.5. EPSS: 4.2% chance of exploitation in the next 30 days.

Multiple buffer overflows in Cyrus IMAPd before 2.2.11 may allow attackers to execute arbitrary code via (1) an off-by-one error in the imapd annotate extension, (2) an off-by-one error in "cached header handling," (3) a stack-based buffer overflow in fetchnews, or (4) a stack-based buffer overflow in imapd.

Affected products

• Cyrus Imapd: version 2.0.17 only; version 2.1.16 only; version 2.1.17 only; version 2.1.18 only; version 2.2.10 only

Published 2005-05-02. Last modified 2026-06-16.