Undefined Behavior for Input to API in Mutt
Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12
- Published
- Sep 9, 2023
- Updated
- Jul 25, 2026
- EPSS
- 0.6% · 44th percentile
- CWE
- CWE-475
Sign in to follow · You’ll be notified if a followed record enters KEV, gets an exploit or is updated.
Report tools
Action score
22
Monitor
Low priority for now.
- CVSS
- 22 / 40 · 5.7 / 10
- CISA KEV
- 0 / 30 · Not listed
- EPSS
- 0 / 30 · 0.6%
CISA SSVC decision
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
Vulnrichment: CISA's decision-tree inputs.
CNA vs NVD score
- NVD
- 5.7
- CNA · GitLab
- 2.2
- 3.5 point gap
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
The score given by the assigning authority versus NVD’s independent score. A gap means the severity is contested.
Affected systems
Affected versions
NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.
- debian debian linux10.0
- debian debian linux11.0
- debian debian linux12.0
- mutt muttafter 1.5.2 · before 2.2.12
Versions reported by the vendor
Affected version ranges reported by the assigning authority (GitLab). Independent of NVD's CPE analysis and usually ahead of it.
Mutt Mutt
- 1.5.2 and later · before 2.2.12affected · semver
Package-level exposure
OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.
| Ecosystem | Package | Affected range | Fix |
|---|---|---|---|
| AlmaLinux:8 | mutt | before 5:2.0.7-3.el8 | 5:2.0.7-3.el8 |
| AlmaLinux:9 | mutt | before 5:2.2.6-2.el9 | 5:2.2.6-2.el9 |
| Debian:10 | mutt | before 1.10.1-2.1+deb10u7 | 1.10.1-2.1+deb10u7 |
| Debian:11 | mutt | before 2.0.5-4.1+deb11u3 | 2.0.5-4.1+deb11u3 |
| Debian:12 | mutt | before 2.2.9-1+deb12u1 | 2.2.9-1+deb12u1 |
| Debian:13 | mutt | before 2.2.12-0.1 | 2.2.12-0.1 |
| openSUSE:Tumbleweed | mutt | before 2.2.12-1.1 | 2.2.12-1.1 |
| Red Hat:enterprise_linux:8::appstream | mutt | before 5:2.0.7-3.el8 | 5:2.0.7-3.el8 |
| Red Hat:enterprise_linux:8::appstream | mutt-debuginfo | before 5:2.0.7-3.el8 | 5:2.0.7-3.el8 |
| Red Hat:enterprise_linux:8::appstream | mutt-debugsource | before 5:2.0.7-3.el8 | 5:2.0.7-3.el8 |
| Red Hat:enterprise_linux:9::appstream | mutt | before 5:2.2.6-2.el9 | 5:2.2.6-2.el9 |
| Red Hat:enterprise_linux:9::appstream | mutt-debuginfo | before 5:2.2.6-2.el9 | 5:2.2.6-2.el9 |
| Red Hat:enterprise_linux:9::appstream | mutt-debugsource | before 5:2.2.6-2.el9 | 5:2.2.6-2.el9 |
| Rocky Linux:8 | mutt | before 5:2.0.7-3.el8 | 5:2.0.7-3.el8 |
| Rocky Linux:9 | mutt | before 5:2.2.6-2.el9 | 5:2.2.6-2.el9 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP4 | mutt | before 1.10.1-150000.3.26.1 | 1.10.1-150000.3.26.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP4 | mutt | before 1.10.1-150000.3.26.1 | 1.10.1-150000.3.26.1 |
| SUSE:Linux Enterprise Server 12 SP5 | mutt | before 1.10.1-55.30.1 | 1.10.1-55.30.1 |
Same product
mutt: all recordsOther highest-scoring records for the same primary product.
- CVE-2018-14354An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16.41Plan
- CVE-2018-14362An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16.40Plan
- CVE-2018-14359An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16.40Plan
- CVE-2018-14358An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16.40Plan
- CVE-2018-14357An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16.40Plan
- CVE-2018-14356An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16.40Plan
Remediation
Which version to upgrade to
Fix versions compiled from the vendor, package registries and Microsoft. Verify the vendor's note before upgrading.
| Product / package | Fixed version | Source |
|---|---|---|
| Mutt Mutt | 2.2.12 | Vendor (CNA) |
| almalinux:mutt | 5:2.2.6-2.el9 · AlmaLinux:9 | Package registry (OSV) |
| debian:mutt | 2.2.9-1+deb12u1 · Debian:12 | Package registry (OSV) |
| opensuse:mutt | 1.10.1-150000.3.26.1 · openSUSE:Leap 15.4 | Package registry (OSV) |
| red hat:mutt | 5:2.2.6-2.el9 · Red Hat:enterprise_linux:9::appstream | Package registry (OSV) |
| red hat:mutt-debuginfo | 5:2.2.6-2.el9 · Red Hat:enterprise_linux:9::appstream | Package registry (OSV) |
| red hat:mutt-debugsource | 5:2.2.6-2.el9 · Red Hat:enterprise_linux:9::appstream | Package registry (OSV) |
| rocky linux:mutt | 5:2.2.6-2.el9 · Rocky Linux:9 | Package registry (OSV) |
| suse:mutt | 1.10.1-150000.3.26.1 · SUSE:Linux Enterprise Module for Basesystem 15 SP4 | Package registry (OSV) |
| suse:mutt | 1.10.1-55.30.1 · SUSE:Linux Enterprise Server 12 SP5 | Package registry (OSV) |
Exploit status
No known public exploit
No public exploit has been observed yet. That doesn't mean you're safe, only that the bar is a little higher.
Research context
For pentesters and researchers: attack profile, score disagreement, timeline, patch commits, credits, variant and chain candidates, bug bounty scope. All derived from existing data; no exploit code.
Timeline
From publication to today: proof of concept, Metasploit module, CISA KEV and fix record. Dates are as reported by the sources.
No dated events beyond publication.
FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).
Patch and commit links
Commit, PR and diff links among the references. A starting point for patch-diffing and variant hunting; fixes, not exploits.
Credits
All researchersFinders, reporters and analysts named in the CNA record. Click a name for that researcher’s other records.
- Chenyuan Mifinder
Variant candidates
Same product, same weakness class, within 18 months. If the patch missed the root cause, the sibling bug is here.
No nightly-computed relations.
Chain candidates
An authentication bypass and a privilege-requiring bug in the same product, published close together: combined they may become an unauthenticated path.
—
Bug bounty scope
No known public program.
Source: bounty-targets-data (public HackerOne, Bugcrowd, Intigriti, YesWeHack listings).
Technical details
Attack conditions
- Anyone who can reach it over the internet can trigger it.
- A low-privileged account is enough.
- A user must open a link or visit a page.
- No special conditions are required; it is repeatable.
If successful
- Confidentiality
- none
- Integrity
- none
- Availability
- high · the service can be disrupted
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality impact
- None
- Integrity impact
- None
- Availability impact
- High
Weakness class (CWE)
CWE-475 · Undefined Behavior for Input to APICVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
nvd-primary
Attack context
MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.
MITRE has no CAPEC/ATT&CK mapping for this CWE.
Noroxi analysis
No Noroxi analysis for this record yet
We don't hand-write analysis for all 385,000+ vulnerabilities; that wouldn't be honest. For notable, high-impact vulnerabilities our team writes the mechanism, detection and remediation steps.
We use this product, ask for helpChange log
- Fix✗ → ✓
For records you follow, these changes also arrive as notifications. →
References
- gitlab.com/muttmua/mutt/-/commit/452ee330e094bfc7c9a68555e5152b1826534555.patch
- gitlab.com/muttmua/mutt/-/commit/4cc3128abdf52c615911589394a03271fddeefc6.patch
- www.openwall.com/lists/oss-security/2023/09/26/6
- lists.debian.org/debian-lts-announce/2023/09/msg00021.html
- www.debian.org/security/2023/dsa-5494
Vendor advisories and official records. Exploit/PoC links are deliberately left out.