CVE-2014-0467

Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of...

5.0 MediumFix available

Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion.

Exploit likelihood

4.48%Up 2.5 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion.

Record: CVE-2014-0467
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion.

Record: CVE-2014-0467
Updated: 2026-11-02

EUVDEUVD-2014-0505 No score

Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion.

Record: EUVD-2014-0505
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qw3h-r7wr-mxvx No score

Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of...

Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion.

Record: GHSA-qw3h-r7wr-mxvx
Weakness: CWE-119
Updated: 2026-11-02

OSV No score

Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion.

Record: CVE-2014-0467
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-0467 No score

Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion.

Record: DEBIAN-CVE-2014-0467
Updated: 2026-11-02

OSVMGASA-2014-0141 No score

Updated mutt package fixes security vulnerability

A heap-based buffer overflow flaw was found in the way mutt processed certain email headers. A remote attacker could use this flaw to send an email with specially crafted headers that, when processed, could cause mutt to crash or, potentially, execute arbitrary code with the permissions of the user running mutt (CVE-2014-0467).

Record: MGASA-2014-0141
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10198-1 No score

mutt-1.6.2-3.1 on GA media

These are all security issues fixed in the mutt-1.6.2-3.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10198-1
Updated: 2026-11-02

OSVSUSE-SU-2015:0758-1 No score

Security update for mutt

The mailreader mutt was updated to fix a security issue in displaying mail headers, where a crafted e-mail could cause a heap overflow, which in turn might be used by attackers to crash mutt or potentially even execute code.

Security Issues references:

* CVE-2014-0467
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0467>

Record: SUSE-SU-2015:0758-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`mutt` Debian:12	before 1.5.22-2	1.5.22-2
`mutt` Debian:13	before 1.5.22-2	1.5.22-2
`mutt` Debian:14	before 1.5.22-2	1.5.22-2
`mutt` Debian:6.0	before 1.5.20-9+squeeze3, plus listed versions 1.5.20-9+squeeze11.5.20-9+squeeze2	1.5.20-9+squeeze3
`mutt` Debian:7	before 1.5.21-6.2+deb7u2, plus listed versions 1.5.21-6.21.5.21-6.2+deb7u11.5.21-6.2+deb7u2~bpo60+1	1.5.21-6.2+deb7u2
`mutt` Mageia:3	before 1.5.21-10.1.mga3	1.5.21-10.1.mga3
`mutt` Mageia:4	before 1.5.21-12.1.mga4	1.5.21-12.1.mga4
`mutt` Red Hat:enterprise_linux:6::client	before 5:1.5.20-4.20091214hg736b6a.el6_5	5:1.5.20-4.20091214hg736b6a.el6_5
`mutt-debuginfo` Red Hat:enterprise_linux:6::client	before 5:1.5.20-4.20091214hg736b6a.el6_5	5:1.5.20-4.20091214hg736b6a.el6_5
`mutt` Red Hat:enterprise_linux:6::computenode	before 5:1.5.20-4.20091214hg736b6a.el6_5	5:1.5.20-4.20091214hg736b6a.el6_5

Show 6 moreShow less

Affected packages
Package	Affected	Fixed
`mutt-debuginfo` Red Hat:enterprise_linux:6::computenode	before 5:1.5.20-4.20091214hg736b6a.el6_5	5:1.5.20-4.20091214hg736b6a.el6_5
`mutt` Red Hat:enterprise_linux:6::server	before 5:1.5.20-4.20091214hg736b6a.el6_5	5:1.5.20-4.20091214hg736b6a.el6_5
`mutt-debuginfo` Red Hat:enterprise_linux:6::server	before 5:1.5.20-4.20091214hg736b6a.el6_5	5:1.5.20-4.20091214hg736b6a.el6_5
`mutt` Red Hat:enterprise_linux:6::workstation	before 5:1.5.20-4.20091214hg736b6a.el6_5	5:1.5.20-4.20091214hg736b6a.el6_5
`mutt-debuginfo` Red Hat:enterprise_linux:6::workstation	before 5:1.5.20-4.20091214hg736b6a.el6_5	5:1.5.20-4.20091214hg736b6a.el6_5
`mutt` openSUSE:Tumbleweed	before 1.6.2-3.1	1.6.2-3.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-0467 is a medium vulnerability (CVSS 5.0) in Mutt, published March 12, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.48%, the 91st percentile. Fixed in mutt 1.5.22-2.

References

Show 20 moreShow less