mutt CVE-2026-43864

CRITICAL: Exploitation requires the following specific conditions: (1) Mutt must be configured with GPG signature verification enabled (default in most distributions), (2) the user must actively open or view an email containing the malicious signature block, and (3) the email must be crafted to produce a null key->subkeys pointer in mutt's GPG handling routine. Exploitation is NOT possible via email receipt alone (no automatic trigger); it requires explicit user action to display the message. Authentication is not required (PR:N) but the attack is constrained to local access and high complexity (AC:H), meaning reproducibility and reliability are low. Desktop/workstation deployment is implicit; headless or non-interactive mail servers are unaffected.

This vulnerability presents minimal real-world risk despite meeting denial-of-service criteria. The CVSS vector (AV:L/AC:H/PR:N/UI:R) indicates local attack vector, high complexity, and required user interaction, collectively constraining practical exploitability. EPSS data not provided, but the combination of low CVSS (2.5), local-only attack surface, and mandatory user action (viewing email) suggests negligible exploitation probability. The impact is limited to application availability (A:L) with no confidentiality or integrity compromise. This is a legitimate DoS but only affects users who open emails with deliberately malformed GPG signatures; typical email users are unlikely to encounter such payloads organically. The vulnerability is not tracked in CISA KEV and no public exploit exists, indicating no active exploitation in the wild.

An attacker crafts an email with a malicious GPG signature block designed to cause mutt's signature verification routine to dereference a null key subkey pointer. When a mutt user receives and opens this email (triggering signature display), the application crashes and terminates, requiring the user to restart mutt. The attack requires the target to actively view the email and have GPG signature verification enabled, limiting practical attack scope to sophisticated email-based denial of service against specific mutt users.