CVE-2026-43859: Low severity Mutt Mutt vulnerability
Published May 4, 2026
·Updated
mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP authcram MD5 digest.
Affected Software
1 affected component
Mutt Mutt<2.3.2
Event History
May 4, 2026
CVE Published
via MITRE·05:41 AM
Data Sourced
via MITRE·05:41 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-43859?
CVE-2026-43859 is considered a moderate severity vulnerability due to its potential impact on security during IMAP authentication.
2
How do I fix CVE-2026-43859?
To fix CVE-2026-43859, upgrade to Mutt version 2.3.2 or later, where this issue has been resolved.
3
What type of vulnerability is CVE-2026-43859?
CVE-2026-43859 is a coding error vulnerability where strfcpy is incorrectly used instead of memcpy in IMAP authentication.
4
Which versions of Mutt are affected by CVE-2026-43859?
Mutt versions prior to 2.3.2 are affected by CVE-2026-43859.
5
Is CVE-2026-43859 related to IMAP authentication?
Yes, CVE-2026-43859 specifically affects the IMAP auth_cram MD5 digest process.