Vulnerability in Mutt

CVE-2026-107570

heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.

Published 2026-10-08 · last modified 2026-10-08.

CVSS v3 metric

CVSS v3 base score 2.5 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Mutt

Weakness classification (CWE)

CWE-823

References

gitlab.com/muttmua/mutt/-/work_items/533

Frequently asked questions

What is CVE-2026-107570?: CVE-2026-107570 is a low-severity vulnerability in Mutt, classified under CWE-823. CVSS score: 2.5/10. Published 2026-10-08.
How severe is CVE-2026-107570?: Low severity. CVSS v3 base score is 2.5 out of 10.