CVE-2026-43863
Infinite Loop in Mutt Email Client
Publication date: 2026-05-04
Last updated on: 2026-05-04
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| muttmua | mutt | to 2.3.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-253 | The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an infinite loop in the mutt email client, specifically in the function data_object_to_stream within the crypt-gpgme.c file. The problem arises because the code does not properly handle a -1 return value from a read operation, causing the loop to continue indefinitely.
As a result, the program may print excessively beyond the intended buffer size into the stream, which can lead to memory corruption or other unintended behaviors.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability impact me? :
The infinite loop can cause the mutt email client to hang or become unresponsive due to the continuous looping.
Additionally, the excessive printing beyond the buffer size may lead to memory corruption, which could potentially be exploited to cause crashes or other unpredictable behavior in the application.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update the mutt email client to a version later than 2.3.2 where the infinite loop issue in the gpgme data_object_to_stream() function has been fixed.
The fix involves handling the -1 return value from a read operation properly to prevent the infinite loop and potential memory corruption.