{"id":"CVE-2026-43864","aliases":["AZL-85599","CLSA-2026-1790003865","CLSA-2026-1791192215","DEBIAN-CVE-2026-43864","EUVD-2026-26904","GHSA-gwv2-2c9f-hmfv","OESA-2026-2200","SUSE-SU-2026:22340-1","SUSE-SU-2026:2300-1","SUSE-SU-2026:2301-1","UBUNTU-CVE-2026-43864","openSUSE-SU-2026:21016-1"],"status":"published","title":"mutt before 2.3.2 has a show_sig_summary NULL pointer dereference.","description":"mutt before 2.3.2 has a show_sig_summary NULL pointer dereference.","severity":{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00096,"percentile":0.00695,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2026-05-04T06:10:52Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Debian:13","package":"mutt","fixed_in":["2.2.13-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mutt","fixed_in":["2.3.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.2.12-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:2.2.6-2.el9_6.tuxcare.els3"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:2.2.6-1.el9_2.tuxcare.els4"}]}],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.12-0.1","2.2.12-0.1~deb12u1","2.2.13-1","2.2.9-1","2.2.9-1+deb12u1","2.3.2-1","2.4.0-1","2.4.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.13-1+deb13u1"}]}],"versions":["2.2.13-1"]},{"source":"osv","ecosystem":"Debian:14","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-1"}]}],"versions":["2.2.13-1"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-4.oe2203sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-4.oe2403sp3"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-4.oe2403sp1"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-4.oe2403sp3"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-4.oe2003sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-160000.2.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-160000.2.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.23-3.1ubuntu1","1.5.23-3.1ubuntu2","1.5.24-1","1.5.24-1build1","1.5.24-1ubuntu0.1","1.5.24-1ubuntu0.2","1.5.24-1ubuntu0.3","1.5.24-1ubuntu0.4","1.5.24-1ubuntu0.5","1.5.24-1ubuntu0.6","1.5.24-1ubuntu0.6+esm2","1.5.24-1ubuntu0.6+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3+neomutt20170609-2build1","1.9.1-2","1.9.1-3","1.9.1-4","1.9.1-5","1.9.2-1","1.9.3-1","1.9.4-2","1.9.4-3","1.9.4-3ubuntu0.1","1.9.4-3ubuntu0.2","1.9.4-3ubuntu0.3","1.9.4-3ubuntu0.4","1.9.4-3ubuntu0.5","1.9.4-3ubuntu0.6","1.9.4-3ubuntu0.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.1-2.1","1.12.2-1","1.12.2-2","1.13.0-1","1.13.2-1","1.13.2-1ubuntu0.1","1.13.2-1ubuntu0.2","1.13.2-1ubuntu0.3","1.13.2-1ubuntu0.4","1.13.2-1ubuntu0.5","1.13.2-1ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.5-4.1build1","2.1.3-1","2.1.4-1","2.1.4-1build1","2.1.4-1ubuntu1.1","2.1.4-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.9-1","2.2.9-1ubuntu0.23.10.1","2.2.12-0.1","2.2.12-0.1build2","2.2.12-0.1build3","2.2.12-0.1build4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.13-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.13-1build2","2.3.2-1","2.4.0-1","2.4.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.13-1","2.2.13-1build1","2.2.13-1build2"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-160000.2.1"}]}],"bundled":6}],"products":[{"vendor":"mutt","product":"mutt"}],"references":[{"url":"https://github.com/muttmua/mutt/commit/ebfa2969042d89303d15334193fcc32866c8a8df","tags":["fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43864","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-gwv2-2c9f-hmfv"},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1790003865.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43861","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43863","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1791192215.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43864.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-43864","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2200","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622340-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1263892","tags":["report"]},{"url":"https://bugzilla.suse.com/1263893","tags":["report"]},{"url":"https://bugzilla.suse.com/1263894","tags":["report"]},{"url":"https://bugzilla.suse.com/1263895","tags":["report"]},{"url":"https://bugzilla.suse.com/1263896","tags":["report"]},{"url":"https://bugzilla.suse.com/1263897","tags":["report"]},{"url":"https://bugzilla.suse.com/1264047","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43864","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262300-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262301-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-43864","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43864","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-43864","description":"mutt before 2.3.2 has a show_sig_summary NULL pointer dereference.","status":"published","published":"2026-05-04T06:10:52.725Z","modified":"2026-05-04T18:26:15.822Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T13:37:25.103021Z"}],"euvd":[{"id":"EUVD-2026-26904","description":"mutt before 2.3.2 has a show_sig_summary NULL pointer dereference.","status":"published","published":"2026-05-04T06:10:52Z","modified":"2026-05-04T18:26:15Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T19:05:17.549765Z"}],"ghsa":[{"id":"GHSA-gwv2-2c9f-hmfv","title":"mutt before 2.3.2 has a show_sig_summary NULL pointer dereference.","description":"mutt before 2.3.2 has a show_sig_summary NULL pointer dereference.","status":"published","published":"2026-05-04T09:31:09Z","modified":"2026-05-04T09:31:15Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:07:54.172768Z"}],"nvd":[{"id":"CVE-2026-43864","description":"mutt before 2.3.2 has a show_sig_summary NULL pointer dereference.","status":"published","published":"2026-05-04T07:16:01.19Z","modified":"2026-06-17T10:49:59.78Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:12:17.022502Z"}],"osv":[{"id":"CVE-2026-43864","description":"mutt before 2.3.2 has a show_sig_summary NULL pointer dereference.","status":"published","published":"2026-05-04T06:10:52.725Z","modified":"2026-10-28T11:10:50.886736038Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:45:04.820169Z"},{"id":"DEBIAN-CVE-2026-43864","description":"mutt before 2.3.2 has a show_sig_summary NULL pointer dereference.","status":"published","published":"2026-05-04T07:16:01.19Z","modified":"2026-10-01T03:03:05.764746465Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"OESA-2026-2200","title":"mutt security update","description":"Mutt is a small but very powerful text-based mail client for Unix operating systems.\r\n\r\nSecurity Fix(es):\n\nmutt before version 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest, which may lead to buffer handling issues.(CVE-2026-43859)\n\nMutt email client before version 2.3.2 contains a vulnerability where the hash_passwd is sometimes truncated by one byte during IMAP auth_cram MD5 digest authentication, potentially causing authentication failures or security issues.(CVE-2026-43860)\n\nmutt before 2.3.2 does not check for \u0026apos;\\0\u0026apos; in url_pct_decode, resulting in improper null byte handling vulnerability.(CVE-2026-43861)\n\nIn mutt before version 2.3.2, the imap_auth_gss security level is mishandled, which may lead to security vulnerabilities.(CVE-2026-43862)\n\nmutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.(CVE-2026-43863)\n\nmutt before version 2.3.2 has a NULL pointer dereference vulnerability in the show_sig_summary function.(CVE-2026-43864)","status":"published","published":"2026-05-09T11:11:11Z","modified":"2026-08-18T01:19:51.018378164Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"UBUNTU-CVE-2026-43864","description":"mutt before 2.3.2 has a show_sig_summary NULL pointer dereference.","status":"published","published":"2026-05-04T07:16:00Z","modified":"2026-10-17T13:00:07.180461743Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T16:56:22.075798Z"},{"id":"AZL-85599","title":"CVE-2026-43864 affecting package mutt 2.2.12-1","description":"mutt before 2.3.2 has a show_sig_summary NULL pointer dereference.","status":"published","published":"2026-05-04T07:16:01Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:25.190302Z"},{"id":"CLSA-2026-1790003865","title":"mutt: Fix of 6 CVEs","description":"- CVE-2026-43859: use memcpy() instead of strfcpy() in hmac_md5() so a binary MD5\n  digest of an over-long IMAP CRAM-MD5 secret is not truncated at an embedded NUL\n- CVE-2026-43860: copy the full MD5_DIGEST_LEN bytes of the hashed IMAP CRAM-MD5\n  secret in hmac_md5() instead of one byte less\n- CVE-2026-43861: reject a percent-encoded NUL (%00) as an invalid character in\n  url_pct_decode()\n- CVE-2026-43862: check that the GSSAPI security-level token is at least 4 bytes\n  before reading it in imap_auth_gss(), and read it as uint32_t\n- CVE-2026-43863: treat a negative gpgme_data_read() return as an error in\n  data_object_to_stream() instead of looping forever\n- CVE-2026-43864: check key and key-\u003esubkeys for NULL in show_sig_summary()","status":"published","published":"2026-09-21T19:20:08Z","modified":"2026-10-26T09:31:35.728398882Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1791192215","title":"mutt: Fix of 5 CVEs","description":"- CVE-2026-43859: use memcpy() for the IMAP CRAM-MD5 secret digest\n- CVE-2026-43860: fix one-byte truncation of the IMAP CRAM-MD5 digest\n- CVE-2026-43862: check GSSAPI security level size in imap_auth_gss()\n- CVE-2026-43863: fix infinite loop in gpgme data_object_to_stream()\n- CVE-2026-43864: fix NULL dereference in show_sig_summary()","status":"published","published":"2026-10-05T09:23:52Z","modified":"2026-10-26T09:30:51.95503477Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"openSUSE-SU-2026:21016-1","title":"Security update for mutt","description":"This update for mutt fixes the following issues\n\n- CVE-2026-43859: `strfcpy` used instead of `memcpy` for the IMAP `auth_cram` MD5 digest (bsc#1263897).\n- CVE-2026-43860: truncation of `hash_passwd` by one byte for IMAP `auth_cram` MD5 digest (bsc#1263896).\n- CVE-2026-43861: missing check for `\\0` in `url_pct_decode` (bsc#1263895).\n- CVE-2026-43862: mishandling of the `imap_auth_gss` security level (bsc#1263894).\n- CVE-2026-43863: infinite loop in `data_object_to_stream` in `crypt-gpgme.c` (bsc#1263893).\n- CVE-2026-43864: NULL pointer dereference in function `show_sig_summary` (bsc#1263892).\n","status":"published","published":"2026-06-22T14:45:20Z","modified":"2026-06-30T18:24:35.873034346Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22340-1","title":"Security update for mutt","description":"This update for mutt fixes the following issues\n\n- CVE-2026-43859: `strfcpy` used instead of `memcpy` for the IMAP `auth_cram` MD5 digest (bsc#1263897).\n- CVE-2026-43860: truncation of `hash_passwd` by one byte for IMAP `auth_cram` MD5 digest (bsc#1263896).\n- CVE-2026-43861: missing check for `\\0` in `url_pct_decode` (bsc#1263895).\n- CVE-2026-43862: mishandling of the `imap_auth_gss` security level (bsc#1263894).\n- CVE-2026-43863: infinite loop in `data_object_to_stream` in `crypt-gpgme.c` (bsc#1263893).\n- CVE-2026-43864: NULL pointer dereference in function `show_sig_summary` (bsc#1263892).\n","status":"published","published":"2026-06-22T14:50:33Z","modified":"2026-07-02T18:24:12.393825787Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2300-1","title":"Security update for mutt","description":"This update for mutt fixes the following issues\n\n- CVE-2026-43859: `strfcpy` used instead of `memcpy` for the IMAP `auth_cram` MD5 digest (bsc#1263897).\n- CVE-2026-43860: truncation of `hash_passwd` by one byte for IMAP `auth_cram` MD5 digest (bsc#1263896).\n- CVE-2026-43861: missing check for `\\0` in `url_pct_decode` (bsc#1263895).\n- CVE-2026-43862: mishandling of the `imap_auth_gss` security level (bsc#1263894).\n- CVE-2026-43863: infinite loop in `data_object_to_stream` in `crypt-gpgme.c` (bsc#1263893).\n- CVE-2026-43864: NULL pointer dereference in function `show_sig_summary` (bsc#1263892).\n","status":"published","published":"2026-06-08T13:54:59Z","modified":"2026-06-09T09:00:04.606082527Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:2301-1","title":"Security update for mutt","description":"This update for mutt fixes the following issues\n\n- CVE-2026-43859: `strfcpy` used instead of `memcpy` for the IMAP `auth_cram` MD5 digest (bsc#1263897).\n- CVE-2026-43860: truncation of `hash_passwd` by one byte for IMAP `auth_cram` MD5 digest (bsc#1263896).\n- CVE-2026-43861: missing check for `\\0` in `url_pct_decode` (bsc#1263895).\n- CVE-2026-43862: mishandling of the `imap_auth_gss` security level (bsc#1263894).\n- CVE-2026-43863: infinite loop in `data_object_to_stream` in `crypt-gpgme.c` (bsc#1263893).\n- CVE-2026-43864: NULL pointer dereference in function `show_sig_summary` (bsc#1263892).\n","status":"published","published":"2026-06-08T13:55:10Z","modified":"2026-06-09T09:00:05.882640209Z","updated_at":"2026-11-02T15:54:03.503431Z"}]}}