Ruby mail gem EUVD-2026-69609

Exploitation requires that an attacker can deliver a crafted email (containing a malformed RFC 2047 encoded-word in the From, To, or Reply-To display name or local-part) to a system running an unpatched mail gem (< 2.9.1) that parses the message using Mail::Utilities.q_value_decode or b_value_decode. The CVSS PR:N and UI:N indicate no authentication to the target application and no user interaction by the processing application are required - the flaw triggers purely on receipt and parsing of the crafted message. Exploitation is limited to scenarios where the application consumes the decoded header value for trust decisions (authorization checks, sender verification allowlists) or displays it to a human reviewer in a security-sensitive context; applications that treat all decoded display names as untrusted user input and do not make authorization decisions from them are not meaningfully exploited beyond cosmetic display differences.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) is consistent with the vulnerability: network-reachable, no authentication, no user interaction required by the processing application, low integrity impact. The I:L rating may understate impact in environments where decoded header values feed authorization logic - if an application gates actions on the decoded From address matching a trusted sender, header manipulation could constitute a meaningful security control bypass. No EPSS data was supplied; without active exploitation (no KEV entry) and no public POC, real-world risk is moderate and primarily affects email-processing pipelines that make trust decisions based on decoded header values rather than treating them as display-only. Applications that only render decoded headers to end-users are exposed to phishing risk. Applications that programmatically compare decoded sender/recipient values against allowlists are exposed to authorization bypass. The CVSS accurately captures the mechanics but defenders should weigh impact based on how decoded header values are consumed downstream.

An attacker sends an email with a crafted From header such as 'From: =?UTF-8?Q?trusted-sender?Q?@corp.example.com?=@attacker.com' to a Ruby application that parses inbound mail using the unpatched mail gem. The vulnerable q_value_decode processes only the first encoded-word boundary greedily, causing the decoded From value to appear as 'trusted-sender@corp.example.com' even though the actual envelope or raw header points to attacker.com. If the application grants elevated privileges or routes messages based on the decoded From address, the attacker bypasses the authorization check; if the decoded value is displayed to a human reviewer, phishing succeeds because the spoofed address looks legitimate.