What is the CVSS score of CVE-2026-43864?

CVE-2026-43864 has a CVSS 3.1 base score of 2.5 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-43864?

Yes, a patch is available for CVE-2026-43864. Update the affected software to the latest version immediately.

mutt CVE-2026-43864

EUVD-2026-26904 LOW

NULL Pointer Dereference (CWE-476)

2026-05-04 mitre

Null Pointer Dereference Denial Of Service Mutt

2.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.5 LOW

AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

May 04, 2026 - 07:31 EUVD

Source Code Evidence Fetched

May 04, 2026 - 07:31 vuln.today

Analysis Generated

May 04, 2026 - 07:31 vuln.today

Patch released

May 04, 2026 - 07:16 nvd

Patch available

EUVD ID Assigned

May 04, 2026 - 07:00 euvd

EUVD-2026-26904

Analysis Generated

May 04, 2026 - 07:00 vuln.today

CVE Published

May 04, 2026 - 06:10 nvd

LOW 2.5

DescriptionCVE.org

mutt before 2.3.2 has a show_sig_summary NULL pointer dereference.

AnalysisAI

Mutt mail client before version 2.3.2 crashes due to a null pointer dereference in the show_sig_summary function when processing GPG signatures, causing denial of service. The vulnerability requires local access and user interaction to trigger (viewing a malicious email with a crafted signature), resulting in application termination with minimal real-world impact. CVSS score of 2.5 reflects low severity; no public exploit or active exploitation confirmed.

Technical ContextAI

The vulnerability exists in mutt's GPG signature verification code (crypt-gpgme.c), specifically the show_sig_summary function that processes and displays cryptographic signature metadata. The root cause is a missing null pointer check (CWE-476) before dereferencing the key->subkeys structure. When a GPG key object lacks a subkeys field, the code attempts to dereference a null pointer, causing the application to crash. The affected CPE cpe:2.3:a:mutt:mutt:*:*:*:*:*:*:*:* indicates all mutt versions before 2.3.2 are vulnerable. The fix validates that both the key and key->subkeys pointers are non-null before accessing the expires member.

RemediationAI

Vendor-released patch: mutt 2.3.2. Upgrade mutt to version 2.3.2 or later, which includes the null pointer check fix in crypt-gpgme.c (commit ebfa2969042d89303d15334193fcc32866c8a8df). For users unable to upgrade immediately, a workaround is to disable GPG signature verification features in mutt's configuration (set crypt_verify_sig=no), though this reduces email security guarantees. Distributions maintaining legacy mutt versions should backport the one-line fix (replacing the conditional logic in show_sig_summary) to their packages. See GitHub repository at https://github.com/muttmua/mutt/ for patch details.