CVE-2026-43864 | Low | 2.5 | 2026-05-04 | mutt before 2.3.2 has a show_sig_summary NULL pointer dereference. |
CVE-2026-43863 | Low | 3.7 | 2026-05-04 | mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c. |
CVE-2026-43862 | Low | 3.7 | 2026-05-04 | In mutt before 2.3.2, the imap_auth_gss security level is mishandled. |
CVE-2026-43861 | Low | 3.7 | 2026-05-04 | mutt before 2.3.2 does not check for '\0' in url_pct_decode. |
CVE-2026-43860 | Low | 3.7 | 2026-05-04 | mutt before 2.3.2 sometimes truncates the hash_passwd by one byte for IMAP auth_cram MD5 digest. |
CVE-2026-43859 | Low | 3.7 | 2026-05-04 | mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest. |
CVE-2024-49395 | Medium | 5.3 | 2024-11-12 | In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from the recipients info. |
CVE-2024-49394 | Medium | 5.3 | 2024-11-12 | In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed em… |
CVE-2024-49393 | Medium | 6.5 | 2024-11-12 | In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their… |
CVE-2023-4875 | Low | 2.2 | 2023-09-09 | Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12 |
CVE-2023-4874 | Medium | 4.3 | 2023-09-09 | Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12 |
CVE-2022-1328 | Medium | 4.3 | 2022-04-14 | Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read past end of input line |
CVE-2021-32055 | Critical | 9.1 | 2021-05-05 | Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync issue in which imap/util.c has an out-of-bounds read in… |
CVE-2021-3181 | Medium | 6.5 | 2021-01-19 | rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semico… |
CVE-2020-28896 | Medium | 5.3 | 2020-11-23 | Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The c… |
CVE-2020-14954 | Medium | 5.9 | 2020-06-21 | Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response… |
CVE-2020-14154 | Medium | 4.8 | 2020-06-15 | Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate. |
CVE-2020-14093 | Medium | 5.9 | 2020-06-15 | Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response. |
CVE-2005-2351 | Medium | 5.5 | 2019-11-01 | Mutt before 1.5.20 patch 7 allows an attacker to cause a denial of service via a series of requests to mutt temporary files. |
CVE-2018-14362 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c does not forbid characters that may have unsafe interaction with message-cac… |
CVE-2018-14359 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They have a buffer overflow via base64 data. |
CVE-2018-14358 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long… |
CVE-2018-14357 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote charact… |
CVE-2018-14356 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c mishandles a zero-length UID. |
CVE-2018-14355 | Medium | 5.3 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/util.c mishandles ".." directory traversal in a mailbox name. |
CVE-2018-14354 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote charact… |
CVE-2018-14353 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap_quote_string in imap/util.c has an integer underflow. |
CVE-2018-14352 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap_quote_string in imap/util.c does not leave room for quote characters, leading… |
CVE-2018-14351 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a long IMAP status mailbox literal count size. |
CVE-2018-14350 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long… |
CVE-2018-14349 | Critical | 9.8 | 2018-07-17 | An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a NO response without a message. |
CVE-2014-9116 | | | 2014-12-02 | The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a… |
CVE-2014-0467 | | | 2014-03-14 | Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to addr… |
CVE-2011-1429 | | | 2011-03-16 | Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to… |
CVE-2009-3766 | | | 2009-10-23 | mutt_ssl.c in mutt 1.5.16 and other versions before 1.5.19, when OpenSSL is used, does not verify the domain name in the subject's Common Name (CN) field of an… |
CVE-2009-3765 | | | 2009-10-23 | mutt_ssl.c in mutt 1.5.19 and 1.5.20, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field… |
CVE-2009-1390 | | | 2009-06-16 | Mutt 1.5.19, when linked against (1) OpenSSL (mutt_ssl.c) or (2) GnuTLS (mutt_ssl_gnutls.c), allows connections when only one TLS certificate in the chain is a… |
CVE-2007-2683 | | | 2007-05-15 | Buffer overflow in Mutt 1.4.2 might allow local users to execute arbitrary code via "&" characters in the GECOS field, which triggers the overflow during alias… |
CVE-2007-1268 | | | 2007-03-06 | Mutt 1.5.13 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Mutt from visually distinguishing between signed and… |
CVE-2006-5298 | | | 2006-10-16 | The mutt_adv_mktemp function in the Mutt mail client 1.5.12 and earlier does not properly verify that temporary files have been created with restricted permiss… |
CVE-2006-5297 | | | 2006-10-16 | Race condition in the safe_open function in the Mutt mail client 1.5.12 and earlier, when creating temporary files in an NFS filesystem, allows local users to… |
CVE-2006-3242 | | | 2006-06-27 | Stack-based buffer overflow in the browse_get_namespace function in imap/browse.c of Mutt 1.4.2.1 and earlier allows remote attackers to cause a denial of serv… |
CVE-2005-2642 | | | 2005-08-23 | Buffer overflow in the mutt_decode_xbit function in Handler.c for Mutt 1.5.10 allows remote attackers to execute arbitrary code, possibly due to interactions w… |
CVE-2004-0078 | | | 2004-03-03 | Buffer overflow in the index menu code (menu_pad_string of menu.c) for Mutt 1.4.1 and earlier allows remote attackers to cause a denial of service (crash) and… |
CVE-2003-0300 | | | 2003-06-16 | The IMAP Client for Sylpheed 0.8.11 allows remote malicious IMAP servers to cause a denial of service (crash) via certain large literal size values that cause… |
CVE-2003-0299 | | | 2003-06-16 | The IMAP Client, as used in mutt 1.4.1 and Balsa 2.0.10, allows remote malicious IMAP servers to cause a denial of service and possibly execute arbitrary code… |
CVE-2003-0167 | | | 2003-04-02 | Multiple off-by-one buffer overflows in the IMAP capability for Mutt 1.3.28 and earlier, and Balsa 1.2.4 and earlier, allow a remote malicious IMAP server to c… |
CVE-2003-0140 | | | 2003-03-24 | Buffer overflow in Mutt 1.4.0 and possibly earlier versions, 1.5.x up to 1.5.3, and other programs that use Mutt code such as Balsa before 2.0.10, allows a rem… |
CVE-2002-0001 | | | 2002-02-27 | Vulnerability in RFC822 address parser in mutt before 1.2.5.1 and mutt 1.3.x before 1.3.25 allows remote attackers to execute arbitrary commands via an imprope… |
CVE-2001-0473 | | | 2001-06-27 | Format string vulnerability in Mutt before 1.2.5 allows a remote malicious IMAP server to execute arbitrary commands. |
CVE-1999-0940 | | | 1999-09-27 | Buffer overflow in mutt mail client allows remote attackers to execute commands via malformed MIME messages. |
CVE-1999-0941 | | | 1998-07-28 | Mutt mail client allows a remote attacker to execute commands via shell metacharacters. |