OESA-2026-4645: mutt security update

Q: What must an attacker do to exploit this issue?

An attacker needs to craft an email with a malicious Content-Type header and have it used as a template. Exploitation also requires local access and user interaction, and the attack complexity is rated high.

Q: What is the expected impact if exploitation succeeds?

The reported impact is integrity-only: the crafted header can trigger a heap out-of-bounds write in convert_file_from_to(). Confidentiality and availability impacts are not indicated by the supplied severity vector.

Published Oct 29, 2026

Updated

Mutt is a small but very powerful text-based mail client for Unix operating systems. Security Fix(es):

heap OOB write in convertfilefromto() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.(CVE-2026-107570)

Affected Software

1 affected componentFixes available

openeuler/mutt<2.2.12-5.oe2403sp1

2.2.12-5.oe2403sp1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/mutt to a version that resolves this vulnerability.
Fixed in 2.2.12-5.oe2403sp1

Event History

Oct 29, 2026

Advisory Published

via OSV·09:03 AM

Data Sourced

via OSV·09:03 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-107570

Frequently Asked Questions

What must an attacker do to exploit this issue?

An attacker needs to craft an email with a malicious Content-Type header and have it used as a template. Exploitation also requires local access and user interaction, and the attack complexity is rated high.

What is the expected impact if exploitation succeeds?

The reported impact is integrity-only: the crafted header can trigger a heap out-of-bounds write in convert_file_from_to(). Confidentiality and availability impacts are not indicated by the supplied severity vector.

OESA-2026-4645: mutt security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What must an attacker do to exploit this issue?

What is the expected impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

What is the expected impact if exploitation succeeds?