CVE-2026-43864
Low · 2.5CVSS
2.5
EPSS
0.1%
Published
May 4, 2026
CISA due date
—
The record
mutt before 2.3.2 has a show_sig_summary NULL pointer dereference.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | mutt | 0 | 2.2.16-160000.2.1 |
Related vulnerabilities
- CVE-2026-43863 mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c. Also affects mutt
- CVE-2026-43859 mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5… Also affects mutt
- CVE-2026-43862 In mutt before 2.3.2, the imap_auth_gss security level is mishandled. Also affects mutt
- CVE-2026-43860 mutt before 2.3.2 sometimes truncates the hash_passwd by one byte for IMAP auth_cram MD5… Also affects mutt
- CVE-2026-43861 mutt before 2.3.2 does not check for '\0' in url_pct_decode. Also affects mutt
- CVE-2026-112405 Pillow is a Python imaging library. CWE-476
- CVE-2026-112392 Pillow is a Python imaging library. CWE-476
- CVE-2026-100348 kin-openapi is a Go project for handling OpenAPI files. CWE-476