Every CVE Search/ Get API key

CVE-2024-49393

Mutt: neomutt: to and cc email header fields are not protected by cryptographic signing

6.5 MediumFix available

In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
None

Exploit likelihood

0.33%Up 0.2 points since Nov 12, 2024
90%50%10%1%

What each source reports

CVE List Score used 6.5

Mutt: neomutt: to and cc email header fields are not protected by cryptographic signing

In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.

Record
CVE-2024-49393
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness
CWE-347
Updated
2026-11-05
EUVDEUVD-2024-43420 6.5

In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.

Record
EUVD-2024-43420
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-05
GitHub AdvisoriesGHSA-hchw-xwhf-3qvm 7.4

In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which...

In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.

Record
GHSA-hchw-xwhf-3qvm
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-347
Updated
2026-11-02
NVD 6.5

In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.

Record
CVE-2024-49393
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-347
Updated
2026-11-05
OSV 6.5

In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.

Record
CVE-2024-49393
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2024-49393 6.5

In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.

Record
DEBIAN-CVE-2024-49393
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2024-49393 6.5

In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.

Record
UBUNTU-CVE-2024-49393
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVMGASA-2025-0070 No score

Updated neomutt packages fix security vulnerabilities

The To and Cc email header fields are not protected by cryptographic signing. (CVE-2024-49393) The In-reply-to email header field is not protected by cryptographic signing. (CVE-2024-49394)

Record
MGASA-2025-0070
Updated
2026-11-02
OSVopenSUSE-SU-2024:14527-1 No score

neomutt-20241114-1.1 on GA media

These are all security issues fixed in the neomutt-20241114-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14527-1
Updated
2026-11-02
OSVUSN-7204-1 No score

neomutt vulnerabilities

Jeriko One discovered that NeoMutt incorrectly handled certain IMAP and POP3 responses. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in a denial of service, or the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14349, CVE-2018-14350, CVE-2018-14351, CVE-2018-14352, CVE-2018-14353, CVE-2018-14354, CVE-2018-14355, CVE-2018-14356, CVE-2018-14357, CVE-2018-14358, CVE-2018-14359, CVE-2018-14362)

Jeriko One discovered that NeoMutt incorrectly handled certain NNTP-related operations. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in denial of service, or the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14360, CVE-2018-14361, CVE-2018-14363)

It was discovered that NeoMutt incorrectly processed additional data when communicating with mail servers. An attacker could possibly use this issue to access senstive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-14954, CVE-2020-28896)

It was discovered that Neomutt incorrectly handled the IMAP QRSync setting. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-32055)

Tavis Ormandy discovered that NeoMutt incorrectly parsed uuencoded text past the length of the string. An attacker could possibly use this issue to enable the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1328)

It was discovered that NeoMutt did not properly encrypt email headers. An attacker could possibly use this issue to receive emails that were not intended for them and access sensitive information. This vulnerability was only fixed in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2024-49393, CVE-2024-49394)

Record
USN-7204-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mutt
Debian:12
 All versions, plus listed versions
2.2.12-0.12.2.12-0.1~deb12u12.2.13-12.2.9-12.2.9-1+deb12u1
Show 4 moreShow less
2.3.2-12.4.0-12.4.1-12.4.1-1.1
 None known
mutt
Debian:13
 All versions, plus listed versions
2.2.13-12.2.13-1+deb13u12.2.13-1+deb13u22.3.2-12.4.0-12.4.1-12.4.1-1.1
 None known
mutt
Debian:14
 All versions, plus listed versions
2.2.13-12.3.2-12.4.0-12.4.1-12.4.1-1.1
 None known
neomutt
Debian:12
 All versions, plus listed versions
20220429+dfsg1-4.120231103+dfsg1-120240425+dfsg-120240425+dfsg-220241002+dfsg-1
Show 23 moreShow less
20241002+dfsg-1~bpo12+120241114+dfsg-120241114+dfsg1-120241212+dfsg-120241212+dfsg-220250109+dfsg-120250113+dfsg-120250113+dfsg-1~bpo12+120250404+dfsg-120250404+dfsg-1~bpo12+120250404+dfsg-220250404+dfsg-2~bpo12+120250404+dfsg-2~bpo12+220250510+dfsg-120250510+dfsg-220250510+dfsg-2~bpo12+120250905+dfsg-120251211+dfsg-120260105+dfsg-120260105+dfsg-1~bpo13+120260406+dfsg-120260504+dfsg-120260616+dfsg-1
 None known
neomutt
Debian:13
 before 20241002+dfsg-1
20241002+dfsg-1
neomutt
Debian:14
 before 20241002+dfsg-1
20241002+dfsg-1
neomutt
Mageia:9
From an advisory covering 2 CVEs
 before 20241002-1.mga9
20241002-1.mga9
mutt
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.5.23-3.1ubuntu11.5.23-3.1ubuntu21.5.24-11.5.24-1build11.5.24-1ubuntu0.1
Show 7 moreShow less
1.5.24-1ubuntu0.21.5.24-1ubuntu0.31.5.24-1ubuntu0.41.5.24-1ubuntu0.51.5.24-1ubuntu0.61.5.24-1ubuntu0.6+esm21.5.24-1ubuntu0.6+esm3
 None known
mutt
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.8.3+neomutt20170609-2build11.9.1-21.9.1-31.9.1-41.9.1-5
Show 11 moreShow less
1.9.2-11.9.3-11.9.4-21.9.4-31.9.4-3ubuntu0.11.9.4-3ubuntu0.21.9.4-3ubuntu0.31.9.4-3ubuntu0.41.9.4-3ubuntu0.51.9.4-3ubuntu0.61.9.4-3ubuntu0.6+esm1
 None known
neomutt
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
20171027-120171027-220171027+dfsg.1-120171027+dfsg.1-220171027+dfsg.1-4
Show 4 moreShow less
20171208+dfsg.1-120171208+dfsg.1-220171215+dfsg.1-120171215+dfsg.1-1ubuntu0.1~esm1
 None known
Show 14 moreShow less
Affected packages
PackageAffectedFixed
mutt
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.10.1-2.11.12.2-11.12.2-21.13.0-11.13.2-1
Show 6 moreShow less
1.13.2-1ubuntu0.11.13.2-1ubuntu0.21.13.2-1ubuntu0.31.13.2-1ubuntu0.41.13.2-1ubuntu0.51.13.2-1ubuntu0.6
 None known
neomutt
Ubuntu:Pro:20.04:LTS
 before 20191207+dfsg.1-1.1ubuntu0.1~esm1, plus listed versions
20180716+dfsg.1-1.220191111+dfsg.1-120191207+dfsg.1-1.1
20191207+dfsg.1-1.1ubuntu0.1~esm1
mutt
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.0.5-4.1build12.1.3-12.1.4-12.1.4-1build12.1.4-1ubuntu1.12.1.4-1ubuntu1.2
 None known
neomutt
Ubuntu:Pro:22.04:LTS
 before 20211029+dfsg1-1ubuntu0.1~esm1, plus listed versions
20201127+dfsg.1-1.220211029+dfsg1-1
20211029+dfsg1-1ubuntu0.1~esm1
mutt
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.2.9-12.2.9-1ubuntu0.23.10.12.2.12-0.12.2.12-0.1build22.2.12-0.1build32.2.12-0.1build4
 None known
neomutt
Ubuntu:Pro:24.04:LTS
 before 20231103+dfsg1-1ubuntu0.1~esm1, plus listed versions
20220429+dfsg1-4.120231103+dfsg1-120231103+dfsg1-1build220231103+dfsg1-1build3
20231103+dfsg1-1ubuntu0.1~esm1
mutt
Ubuntu:25.10
 All versions, plus listed versions
2.2.13-1
 None known
mutt
Ubuntu:26.10
 All versions, plus listed versions
2.2.13-1build22.3.2-12.4.0-12.4.1-1
 None known
mutt
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.2.13-12.2.13-1build12.2.13-1build2
 None known
neomutt
Ubuntu:Pro:18.04:LTS
From an advisory covering 21 CVEs
 before 20171215+dfsg.1-1ubuntu0.1~esm1, plus listed versions
20171027-120171027-220171027+dfsg.1-120171027+dfsg.1-220171027+dfsg.1-420171208+dfsg.1-120171208+dfsg.1-220171215+dfsg.1-1
20171215+dfsg.1-1ubuntu0.1~esm1
neomutt
Ubuntu:Pro:20.04:LTS
From an advisory covering 21 CVEs
 before 20191207+dfsg.1-1.1ubuntu0.1~esm1, plus listed versions
20180716+dfsg.1-1.220191111+dfsg.1-120191207+dfsg.1-1.1
20191207+dfsg.1-1.1ubuntu0.1~esm1
neomutt
Ubuntu:Pro:22.04:LTS
From an advisory covering 21 CVEs
 before 20211029+dfsg1-1ubuntu0.1~esm1, plus listed versions
20201127+dfsg.1-1.220211029+dfsg1-1
20211029+dfsg1-1ubuntu0.1~esm1
neomutt
Ubuntu:Pro:24.04:LTS
From an advisory covering 21 CVEs
 before 20231103+dfsg1-1ubuntu0.1~esm1, plus listed versions
20220429+dfsg1-4.120231103+dfsg1-120231103+dfsg1-1build220231103+dfsg1-1build3
20231103+dfsg1-1ubuntu0.1~esm1
neomutt
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 20241114-1.1
20241114-1.1

History

History
RecordedChangedSources
affectedNVD
factsCVE List, EUVD
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-49393 is a medium vulnerability (CVSS 6.5) in Mutt, published November 12, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 25th percentile. Fixed in neomutt 20241002+dfsg-1.

References

Show 34 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open