Mutt EUVD-2026-94853

Exploitation requires the victim to use an attacker-supplied email message as a composition template in Mutt (the resend/template workflow), and that message must carry a crafted Content-Type header whose charset parameters drive the vulnerable convert_file_from_to() charset conversion to write out of bounds. This is NOT remote-unauthenticated against a default configuration: it needs local processing of the malicious message by the Mutt client (AV:L), deliberate user interaction to invoke the template feature (UI:R), and favorable memory conditions to trigger the OOB write reliably (AC:H). These factors - mandatory user action plus high complexity - substantially limit realistic exploitation beyond the raw score. Affects Mutt versions up to and including 2.4.2.

This is a genuinely low-priority issue despite the 'heap OOB write / memory corruption' framing. The CVSS base score of 2.5 (LOW) is driven by a demanding exploitation profile: AV:L (local vector - the attacker cannot trigger this purely over the network, the malicious message must be processed locally by the client), AC:H (high attack complexity, implying non-deterministic or hard-to-control conditions), and critically UI:R (the victim must actively use an attacker-controlled email as a composition template). Impact is limited to I:L with C:N and A:N. No EPSS score, no CISA KEV listing, and no public exploit (POC) are present in the provided data, so there is no evidence of exploitation probability or active use - consistent with no public exploit identified at time of analysis. One notable internal tension: the description characterizes this as a 'heap OOB write' (a memory-corruption primitive that would normally carry availability and potentially code-execution implications), yet the vendor-supplied CVSS vector rates A:N and only I:L with scope Unchanged - suggesting the vendor assesses the out-of-bounds write as tightly bounded rather than a path to crash or RCE. This discrepancy should be verified against the GitLab advisory before dismissing availability/code-execution risk entirely. Overall: a real but very low-severity, high-friction client-side bug, not an urgent patch priority.

An attacker crafts an email containing a malicious Content-Type header and sends it to a Mutt user. The victim later selects that message to use as a template for composing a new email, at which point convert_file_from_to() performs charset conversion driven by the crafted header and triggers a heap out-of-bounds write. The local vector (AV:L), high complexity (AC:H), and required user interaction (UI:R) make reliable exploitation difficult; no public exploit code exists at time of analysis.