Every CVE Search/ Get API key

CVE-2023-4875

Undefined Behavior for Input to API in Mutt

2.2 LowFix available

CVE-2023-4875 is a low vulnerability (CVSS 2.2) in Mutt, published September 9, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. Fixed in mutt 5:2.2.6-2.el9.

Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.55%Up 0.5 points since Sep 10, 2023
90%50%10%1%

What each source reports

CVE List Score used 2.2

Undefined Behavior for Input to API in Mutt

Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12

Record
CVE-2023-4875
CVSS 3.1
2.2 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-475
Updated
2026-11-02
EUVDEUVD-2023-54714 2.2

Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12

Record
EUVD-2023-54714
CVSS 3.1
2.2 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-fwwc-f8hw-qfwf 2.2

Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2...

Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12

Record
GHSA-fwwc-f8hw-qfwf
CVSS 3.1
2.2 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-475, CWE-476
Updated
2026-11-02
NVD 2.2

Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12

Record
CVE-2023-4875
CVSS 3.1
2.2 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
CVSS 3.1
5.7 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-475, CWE-476
Updated
2026-11-02
OSVAZL-28699 5.7

CVE-2023-4875 affecting package mutt for versions less than 2.2.12-1

Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12

Record
AZL-28699
CVSS 3.1
5.7 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 2.2

Undefined Behavior for Input to API in Mutt

Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12

Record
CVE-2023-4875
CVSS 3.1
2.2 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-475
Updated
2026-11-02
Show 15 moreShow less
OSVDEBIAN-CVE-2023-4875 5.7

Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12

Record
DEBIAN-CVE-2023-4875
CVSS 3.1
5.7 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2023-1660 6.5

mutt security update

Mutt is a small but very powerful text-based mail client for Unix operating systems.

Security Fix(es):

Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12(CVE-2023-4874)

Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12(CVE-2023-4875)

Record
OESA-2023-1660
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:2290 5.7

Red Hat Security Advisory: mutt security update

Record
RHSA-2024:2290
CVSS 3.1
5.7 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:3058 5.7

Red Hat Security Advisory: mutt security update

Record
RHSA-2024:3058
CVSS 3.1
5.7 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2024:2290 5.7

Moderate: mutt security update

Mutt is a low resource, highly configurable, text-based MIME e-mail client. Mutt supports most e-mail storing formats, such as mbox and Maildir, as well as most protocols, including POP3 and IMAP.

Security Fix(es):

  • mutt: null pointer dereference (CVE-2023-4874)

  • mutt: null pointer dereference (CVE-2023-4875)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section.

Record
RLSA-2024:2290
CVSS 3.1
5.7 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-4875 5.7

Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12

Record
UBUNTU-CVE-2023-4875
CVSS 3.1
5.7 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
CVSS 3.1
2.2 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVALSA-2024:2290 No score

Moderate: mutt security update

Mutt is a low resource, highly configurable, text-based MIME e-mail client. Mutt supports most e-mail storing formats, such as mbox and Maildir, as well as most protocols, including POP3 and IMAP.

Security Fix(es):

  • mutt: null pointer dereference (CVE-2023-4874)
  • mutt: null pointer dereference (CVE-2023-4875)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2024:2290
Updated
2026-11-02
OSVALSA-2024:3058 No score

Moderate: mutt security update

Mutt is a low resource, highly configurable, text-based MIME e-mail client. Mutt supports most e-mail storing formats, such as mbox and Maildir, as well as most protocols, including POP3 and IMAP.

Security Fix(es):

  • mutt: null pointer dereference (CVE-2023-4874)
  • mutt: null pointer dereference (CVE-2023-4875)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2024:3058
Updated
2026-11-02
OSVCLSA-2026-1779825075 No score

mutt: Fix of 2 CVEs

  • CVE-2023-4874: fix NULL pointer dereference in write_one_header()
  • CVE-2023-4875: fix NULL pointer dereference in userhdrs handling
Record
CLSA-2026-1779825075
Updated
2026-11-02
OSVMGASA-2024-0175 No score

Updated mutt packages fix security vulnerabilities

Null pointer dereference when viewing a specially crafted email in Mutt

1.5.2 <2.2.12. (CVE-2023-4874) Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12. (CVE-2023-4875)

Record
MGASA-2024-0175
Updated
2026-11-02
OSVopenSUSE-SU-2024:13222-1 No score

mutt-2.2.12-1.1 on GA media

These are all security issues fixed in the mutt-2.2.12-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13222-1
Updated
2026-11-02
OSVRLSA-2024:3058 No score

Moderate: mutt security update

Mutt is a low resource, highly configurable, text-based MIME e-mail client. Mutt supports most e-mail storing formats, such as mbox and Maildir, as well as most protocols, including POP3 and IMAP.

Security Fix(es):

  • mutt: null pointer dereference (CVE-2023-4874)

  • mutt: null pointer dereference (CVE-2023-4875)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

Record
RLSA-2024:3058
Updated
2026-11-02
OSVSUSE-SU-2023:3702-1 No score

Security update for mutt

This update for mutt fixes the following issues:

  • CVE-2023-4874: Fixed NULL pointer dereference when composing an email (bsc#1215189).
  • CVE-2023-4875: Fixed NULL pointer dereference when receiving an email (bsc#1215191).
Record
SUSE-SU-2023:3702-1
Updated
2026-11-02
OSVSUSE-SU-2023:3826-1 No score

Security update for mutt

This update for mutt fixes the following issues:

  • CVE-2023-4874: Fixed NULL pointer dereference when composing an email (bsc#1215189).
  • CVE-2023-4875: Fixed NULL pointer dereference when receiving an email (bsc#1215191).
Record
SUSE-SU-2023:3826-1
Updated
2026-11-02
OSVUSN-6374-1 No score

mutt vulnerabilities

It was discovered that Mutt incorrectly handled certain email header contents. If a user were tricked into opening a specially crafted message, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-4874, CVE-2023-4875)

Record
USN-6374-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mutt
AlmaLinux:9
 before 5:2.2.6-2.el9
5:2.2.6-2.el9
mutt
AlmaLinux:8
 before 5:2.0.7-3.el8
5:2.0.7-3.el8
mutt
Azure Linux:2
 before 2.2.12-1
2.2.12-1
mutt
TuxCare:AlmaLinux:9.2
 before 5:2.2.6-1.el9_2.tuxcare.els1
5:2.2.6-1.el9_2.tuxcare.els1
mutt
Debian:12
 before 2.2.9-1+deb12u1, plus listed versions
2.2.9-1
2.2.9-1+deb12u1
mutt
Debian:13
 before 2.2.12-0.1
2.2.12-0.1
mutt
Debian:14
 before 2.2.12-0.1
2.2.12-0.1
mutt
Debian:10
 before 1.10.1-2.1+deb10u7, plus listed versions
1.10.1-2.11.10.1-2.1+deb10u11.10.1-2.1+deb10u21.10.1-2.1+deb10u31.10.1-2.1+deb10u41.10.1-2.1+deb10u51.10.1-2.1+deb10u6
1.10.1-2.1+deb10u7
mutt
Debian:11
 before 2.0.5-4.1+deb11u3, plus listed versions
2.0.5-4.12.0.5-4.1+deb11u12.0.5-4.1+deb11u2
2.0.5-4.1+deb11u3
mutt
Mageia:9
 before 2.2.10-1.1.mga9
2.2.10-1.1.mga9
Show 26 moreShow less
Affected packages
PackageAffectedFixed
mutt
openEuler:20.03-LTS-SP1
 before 2.2.12-1.oe1
2.2.12-1.oe1
mutt
openEuler:20.03-LTS-SP3
 before 2.2.12-1.oe1
2.2.12-1.oe1
mutt
openEuler:22.03-LTS
 before 2.2.12-1.oe2203sp2
2.2.12-1.oe2203sp2
mutt
openEuler:22.03-LTS-SP1
 before 2.2.12-1.oe2203sp1
2.2.12-1.oe2203sp1
mutt
openEuler:22.03-LTS-SP2
 before 2.2.12-1.oe2203sp2
2.2.12-1.oe2203sp2
mutt
Red Hat:enterprise_linux:9::appstream
 before 5:2.2.6-2.el9
5:2.2.6-2.el9
mutt-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 5:2.2.6-2.el9
5:2.2.6-2.el9
mutt-debugsource
Red Hat:enterprise_linux:9::appstream
 before 5:2.2.6-2.el9
5:2.2.6-2.el9
mutt
Red Hat:enterprise_linux:8::appstream
 before 5:2.0.7-3.el8
5:2.0.7-3.el8
mutt-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 5:2.0.7-3.el8
5:2.0.7-3.el8
mutt-debugsource
Red Hat:enterprise_linux:8::appstream
 before 5:2.0.7-3.el8
5:2.0.7-3.el8
mutt
Rocky Linux:9
 before 5:2.2.6-2.el9
5:2.2.6-2.el9
mutt
Rocky Linux:8
 before 5:2.0.7-3.el8
5:2.0.7-3.el8
mutt
SUSE:Linux Enterprise Server 12 SP5
 before 1.10.1-55.30.1
1.10.1-55.30.1
mutt
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 1.10.1-55.30.1
1.10.1-55.30.1
mutt
SUSE:Linux Enterprise Module for Basesystem 15 SP4
 before 1.10.1-150000.3.26.1
1.10.1-150000.3.26.1
mutt
SUSE:Linux Enterprise Module for Basesystem 15 SP5
 before 1.10.1-150000.3.26.1
1.10.1-150000.3.26.1
mutt
SUSE:Manager Proxy 4.2
 before 1.10.1-150000.3.26.1
1.10.1-150000.3.26.1
mutt
SUSE:Manager Server 4.2
 before 1.10.1-150000.3.26.1
1.10.1-150000.3.26.1
mutt
openSUSE:Leap 15.4
 before 1.10.1-150000.3.26.1
1.10.1-150000.3.26.1
mutt
openSUSE:Leap 15.5
 before 1.10.1-150000.3.26.1
1.10.1-150000.3.26.1
mutt
Ubuntu:Pro:16.04:LTS
 before 1.5.24-1ubuntu0.6+esm3, plus listed versions
1.5.23-3.1ubuntu11.5.23-3.1ubuntu21.5.24-11.5.24-1build11.5.24-1ubuntu0.1
Show 6 moreShow less
1.5.24-1ubuntu0.21.5.24-1ubuntu0.31.5.24-1ubuntu0.41.5.24-1ubuntu0.51.5.24-1ubuntu0.61.5.24-1ubuntu0.6+esm2
1.5.24-1ubuntu0.6+esm3
mutt
Ubuntu:Pro:18.04:LTS
 before 1.9.4-3ubuntu0.6+esm1, plus listed versions
1.8.3+neomutt20170609-2build11.9.1-21.9.1-31.9.1-41.9.1-5
Show 10 moreShow less
1.9.2-11.9.3-11.9.4-21.9.4-31.9.4-3ubuntu0.11.9.4-3ubuntu0.21.9.4-3ubuntu0.31.9.4-3ubuntu0.41.9.4-3ubuntu0.51.9.4-3ubuntu0.6
1.9.4-3ubuntu0.6+esm1
mutt
Ubuntu:20.04:LTS
 before 1.13.2-1ubuntu0.6, plus listed versions
1.10.1-2.11.12.2-11.12.2-21.13.0-11.13.2-1
Show 5 moreShow less
1.13.2-1ubuntu0.11.13.2-1ubuntu0.21.13.2-1ubuntu0.31.13.2-1ubuntu0.41.13.2-1ubuntu0.5
1.13.2-1ubuntu0.6
mutt
Ubuntu:22.04:LTS
 before 2.1.4-1ubuntu1.2, plus listed versions
2.0.5-4.1build12.1.3-12.1.4-12.1.4-1build12.1.4-1ubuntu1.1
2.1.4-1ubuntu1.2
mutt
openSUSE:Tumbleweed
 before 2.2.12-1.1
2.2.12-1.1

History

History
WhenChangedSources
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 43 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open