GNOME Evolution CVE-2026-88859

The victim must be using the Evolution email client (specifically GNOME Evolution as packaged in RHEL 6-9) and must click on the attacker-crafted vCard control embedded in the HTML email body - passive email preview alone does not trigger execution. No authentication is required from the attacker's perspective: sending an email to the target is sufficient. The victim does not need to have any non-default configuration; the vulnerable code path is in Evolution's default vCard-handling logic. Exploitation is limited to the mail-viewing context - the JavaScript does not directly execute at OS level. The UI:R requirement (one click) is the primary limiting factor and reduces realistic mass-exploitation risk, but targeted spear-phishing campaigns make this gate trivially bypassable against specific individuals.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N yields a score of 5.4 (Medium). The attack requires one user interaction (clicking a vCard control), which is a realistic social-engineering hurdle but far from a high barrier given that vCards are a normal, expected feature in business email. Attack complexity is low - no race conditions or special environment needed. The limited C:L/I:L impact reflects that JavaScript executes only within Evolution's mail-viewer context, not as a system-level code execution primitive; however, within that context an attacker could steal displayed email content, exfiltrate session tokens if Evolution exposes them to the JavaScript context, or perform actions on behalf of the user within the client. EPSS data is not provided, and there is no KEV listing or known public POC, so real-world exploitation probability is currently unquantified. The Medium CVSS is plausible given the UI:R gate, but defenders on RHEL desktops where Evolution is the default mail client should treat this seriously due to the ease of delivery and the fact that vCard controls are not suspicious to end users.

An attacker sends a business-plausible HTML email to a target who uses Evolution on RHEL, embedding a spoofed vCard attachment link that visually resembles a legitimate contact card. When the target clicks the vCard control within Evolution, the client's internal handler injects the attacker's javascript: URL as the iframe src, executing JavaScript that reads the current email session content and exfiltrates it to an attacker-controlled server. No public exploit code is known, but the technique is well-understood in the context of email client XSS and would be straightforward to reproduce from the description alone.