CVE-2021-3657: Debian Linux

Critical severity, CVSS 9.8. EPSS: 3.5% chance of exploitation in the next 30 days.

A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders, could cause several different buffer overflows, which could conceivably be exploited for remote code execution.

Affected products

• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 35 only
• Isync Project Isync: before 1.4.4 (fixed in 1.4.4)
• Red Hat Enterprise Linux: version 7.0 only

Published 2022-02-18. Last modified 2026-06-17.