CVE-2026-43859

Published: May 4, 2026Modified: Jun 17, 2026Deferred

3.7

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.2 / Impact: 1.4

Source: MITRE (Secondary)

Description

mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest.

Related CWEs

Improper Neutralization of Null Byte or NUL Character

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.

References (1)

https://github.com/muttmua/mutt/commit/834c5a2ed0479e51e8662a31caed129f136f4805

Source: cve@mitre.org

Timeline

No history available yet.