Mutt CVE-2026-43859

Exploitation requires: (1) IMAP CRAM-MD5 authentication must be enabled and attempted (not all mail servers or Mutt configurations use this method); (2) the attacker must either operate a malicious IMAP server the user connects to, or be positioned on-path to intercept and manipulate IMAP traffic; (3) the naturally occurring MD5 digest must contain a null byte at a position that reduces authentication security (the probability depends on the specific password and challenge, making this non-deterministic); (4) the targeted mail server must accept the truncated digest as valid authentication, which depends on server-side validation logic. In typical deployments, authenticated users with configured IMAP servers of their choice face minimal risk; users connecting to untrusted or user-specified servers face higher (though still complexity-limited) risk. Default Mutt configurations may or may not enable CRAM-MD5; this depends on compile-time options and mail server advertisement.

This vulnerability presents minimal real-world risk despite network-accessible attack vector. CVSS 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects high attack complexity (AC:H), indicating the attacker must satisfy difficult conditions - specifically, the MD5 digest must naturally contain a null byte in a position that causes meaningful truncation. The tag 'Information Disclosure' conflicts with the CVSS confidentiality impact (C:N), suggesting integrity compromise rather than confidentiality breach. The impact is limited to integrity (I:L), not system availability or core confidentiality. No EPSS score, KEV status, or public exploit availability reported; this is a 'quiet' vulnerability unlikely to be actively exploited in the wild. The attack requires either (1) the user to authenticate against a malicious IMAP server that crafts specific challenges, or (2) an on-path attacker to intercept and manipulate IMAP traffic. Defenders should assess Mutt's role in their environment: if IMAP is used only internally or with trusted servers, risk is negligible. For external or untrusted IMAP access, the AC:H barrier remains high.

An attacker operates a malicious IMAP server and tricks a Mutt user into connecting (via misconfigured server list or phishing). When the server initiates CRAM-MD5 authentication, it sends a challenge crafted so that the resulting MD5 digest contains a null byte early in its byte sequence. Mutt's strfcpy truncates the digest at that null byte, shortening the authentication material. The attacker, knowing this truncation, pre-computes a response using the truncated digest and sends it, potentially allowing authentication bypass or credential forgery.