Mutt CVE-2026-43863

The vulnerability requires processing of GPG-encrypted messages by mutt with GPGME support enabled (default configuration). Specifically, the data_object_to_stream function must be invoked during encryption/decryption workflows, which occurs when mutt interacts with encrypted message content. The exploitation depends on GPGME library behavior returning zero or a negative value (error condition) from gpgme_data_read() while processing malformed or crafted encrypted data-not a typical condition in normal operation. No authentication is required if the attacker can send a message to the targeted user or control a message in a shared folder. The high CVSS complexity (AC:H) reflects the difficulty in reliably triggering the root condition; it is not trivial to craft input that causes gpgme_data_read() to behave unexpectedly without control over the GPGME library's internal state.

Despite the high CVSS score of 3.7, real-world risk is LOW to MODERATE. CVSS vector components show attack vector network (AV:N) but high complexity (AC:H), no privileges required (PR:N), and impact limited to availability (A:L) with no confidentiality or integrity loss. The high complexity requirement indicates non-trivial reproduction conditions; the attack vector being remote but availability-only means this is a resource exhaustion DoS rather than remote code execution. No exploitation data is available-no CISA KEV listing, no public POC code identified, and no reports of active exploitation. The vulnerability requires specific interaction with GPG-encrypted messages and depends on GPGME library behavior, both limiting attack surface. However, any authenticated user capable of sending or processing GPG-encrypted messages could potentially trigger this remotely, making it a concern for mail servers and multi-user systems. The upstream fix is trivial (a single boolean comparison change), lowering remediation friction. Organizations should prioritize patching based on email threat model rather than raw CVSS.

An attacker sends a specially crafted GPG-encrypted email message to a mutt user where the GPGME library returns an unexpected condition (zero or negative value) from gpgme_data_read() during decryption. When the user attempts to view or process the message, mutt enters an infinite loop in data_object_to_stream, consuming CPU and potentially memory until the process is manually killed, causing local denial of service to that user's mail session.