PT-2026-36774 · Mutt · Mutt

Evilrabbit · Published 2026-05-04 · Updated 2026-05-09 · CVE-2026-43861

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions mutt versions prior to 2.3.2

Description The software fails to check for the null character '0' within the url pct decode() function.

Recommendations Update to version 2.3.2 or later.

Fix

Weakness Enumeration

CWE-158

Related Identifiers

CVE-2026-43861

OESA-2026-2200

OPENSUSE-SU-2026:10695-1

Affected Products

Mutt

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2026-43862 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43859 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-43861 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43860 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10695-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43861 · Security Note
• https://ubuntu.com/security/CVE-2026-43861 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43863 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2200 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43861 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43861 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43864 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43861 · Vendor Advisory
• https://github.com/muttmua/mutt/commit/12f54fe3b61f761c096fe95e95d5e3072af00ed2 · Note
• https://suse.com/security/cve/CVE-2026-43861 · Note