mutt CVE-2026-43862

Exploitation requires the following specific conditions: (1) Mutt must be configured to use GSS-API authentication (imap_authenticators includes 'gss'), which is not enabled by default in all distributions. (2) The user must connect to an IMAP server controlled by the attacker or reachable via a network path under attacker control (MITM is necessary because AC:H indicates high complexity - a legitimate server will not trigger this). (3) The IMAP server must be at the authentication negotiation phase when the client sends the GSS token. (4) The attacker must craft a GSS token response that either has length less than 4 bytes or contains specific byte patterns in the first 4 bytes to trigger the integer conversion. Default mutt configurations without explicit GSS-API enablement are not vulnerable in normal operation.

CVSS 3.7 (low-moderate) reflects the high attack complexity requirement (AC:H) - an attacker must control or MITM the IMAP server, not just send network packets. The vector AV:N/PR:N/UI:N is misleading in isolation: while network-accessible, AC:H significantly limits real-world impact. EPSS score not provided, limiting probability assessment. No KEV listing and no public POC identified indicate this is not actively exploited in the wild. The memory corruption potential (Memory Corruption tag) could theoretically enable code execution, but the fixed CVSS scope (S:U) and integrity-only impact (I:L) suggest the vulnerability is limited to information disclosure or denial of service rather than arbitrary code execution. The fix is trivial (type correction and bounds check), suggesting this was a logic error rather than a sophisticated vulnerability. Real-world priority is LOW for most deployments unless users connect to untrusted IMAP servers or operate in environments with IMAP MITM risk.

An attacker controlling a malicious IMAP server or performing a MITM attack on IMAP traffic receives a connection from a mutt client configured to use GSS-API authentication. During the security negotiation phase, the server sends a crafted GSS token shorter than 4 bytes or with malicious content in the security level field. Mutt reads past the token buffer, leaking sensitive memory contents, or writes to adjacent memory, causing crashes or potential code execution if combined with heap layout control.