CVE-2026-75002

CVE-2026-75002 is a byte-count desynchronization vulnerability in Roundcube's IMAP LITERAL+ handling within the search functionality. The core issue: when parsing IMAP responses containing literal data (binary attachments, search results), the client must consume exactly N bytes before resuming command parsing. A single off-by-one error in this counting causes subsequent server responses to be misinterpreted as fresh IMAP commands rather than continuation data — creating a state where an attacker who can trigger the desync (via a crafted email) can inject arbitrary IMAP commands into the client's command stream. The critical misassessment to avoid: this is not a vulnerability limited to search functionality. The IMAP parser maintains shared state that persists across all operations. Once desynchronized, every subsequent IMAP command — fetch, copy, move, delete, folder enumeration — operates against a corrupted parser context. The privilege escalation is not "I can perform one unauthorized action" but "I now control the command channel indefinitely." This means the blast radius extends far beyond the search feature that triggered it. Check your IMAP library's literal-handling code paths. The vulnerability likely exists wherever variable-length literals are consumed, particularly in code paths handling search results, attachments, or custom folder operations. Verify that parser state is isolated per operation or explicitly reset after literal consumption — the absence of such reset is the latent condition. The historical record is damning: Pine, Evolution, Thunderbird extensions, and multiple Roundcube releases have all suffered this exact failure mode. Each CVE scores in the medium range, which consistently fails to justify the architectural investment needed to eliminate the class. This is not a Roundcube-specific negligence — it's a recurring vulnerability class that the CVSS scoring framework systematically underestimates by measuring trigger conditions rather than state corruption effects. The structural fix requires either parser state isolation, formal verification of byte-count invariants, or IMAP library-level guarantees that most implementations lack.

Reviewed through automated stages and approved by a human before publication.