Mutt Mutt vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Mutt Mutt: 7 record(s), with affected versions and fixes.
CVE-2026-107570
Low · 2.5
CWE-823 Oct 8, 2026
Use of Out-of-range Pointer Offset in mutt
heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.
CVE-2026-43864
Low · 2.5
CWE-476 May 4, 2026
NULL Pointer Dereference in Mutt
mutt before 2.3.2 has a show_sig_summary NULL pointer dereference.
CVE-2026-43863
Low · 3.7
CWE-253 May 4, 2026
mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.
mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.
CVE-2026-43862
Low · 3.7
CWE-843 May 4, 2026
Type Confusion in Mutt
In mutt before 2.3.2, the imap_auth_gss security level is mishandled.
CVE-2026-43861
Low · 3.7
CWE-158 May 4, 2026
mutt before 2.3.2 does not check for '\0' in url_pct_decode.
mutt before 2.3.2 does not check for '\0' in url_pct_decode.
CVE-2026-43860
Low · 3.7
CWE-193 May 4, 2026
mutt before 2.3.2 sometimes truncates the hash_passwd by one byte for IMAP auth_cram MD5…
mutt before 2.3.2 sometimes truncates the hash_passwd by one byte for IMAP auth_cram MD5 digest.
CVE-2026-43859
Low · 3.7
CWE-158 May 4, 2026
mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5…
mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest.