CVE-2021-44143: A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unchecked condition, a malicious or compromised IMAP server could use a crafted mail message…

PriorityP258critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

3.66%

88.2th percentile

A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unchecked condition, a malicious or compromised IMAP server could use a crafted mail message that lacks headers (i.e., one that starts with an empty line) to provoke a heap overflow, which could conceivably be exploited for remote code execution.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	debian_linux	—	—
debian	debian_linux	—	—
debian	isync	< isync 1.4.4-1 (bookworm)	isync 1.4.4-1 (bookworm)
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
isync_project	isync	>= 0 < 1.4.4-1	1.4.4-1
isync_project	isync	>= 0 < 1.4.4-1	1.4.4-1
isync_project	isync	>= 0 < 1.4.4-1	1.4.4-1
isync_project	isync	1.4.0 – 1.4.3	—

Detection & IOCsextracted from sources · hover to see the quote

→A crafted mail message that lacks headers (starts with an empty line) delivered via a malicious or compromised IMAP server can trigger a heap overflow in mbsync (isync 1.4.0–1.4.3). Monitor for IMAP sessions delivering messages with no headers (i.e., body begins immediately with an empty line / CRLF CRLF at the very start of the message content). ↗

·Only isync versions 1.4.0 through 1.4.3 are vulnerable; the issue is fixed in 1.4.4. Verify the installed mbsync/isync version before deploying detections. ↗
·Exploitation requires a malicious or compromised IMAP server — the attack vector is the IMAP server side, not a direct client-to-client path. Scope is assessed as local by Debian. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

osv9.8CRITICAL

vendor_debian9.8CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.