PT-2026-36772 · Mutt · Mutt

Evilrabbit · Published 2026-05-04 · Updated 2026-05-09 · CVE-2026-43859

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions mutt versions prior to 2.3.2

Description The software sometimes uses the strfcpy() function instead of memcpy() when handling the IMAP auth cram MD5 digest. This occurs during the authentication process for IMAP servers using the CRAM-MD5 mechanism.

Recommendations Update to version 2.3.2 or later.

Fix

Weakness Enumeration

CWE-158

Related Identifiers

CVE-2026-43859

OESA-2026-2200

OPENSUSE-SU-2026:10695-1

Affected Products

Mutt

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2026-43862 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43859 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43859 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43859 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43860 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10695-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43863 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2200 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43859 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43861 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43864 · Security Note
• https://ubuntu.com/security/CVE-2026-43859 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43859 · Vendor Advisory
• https://github.com/muttmua/mutt/commit/834c5a2ed0479e51e8662a31caed129f136f4805 · Note
• https://suse.com/security/cve/CVE-2026-43861 · Note