Marked for autoremoval on 22 November: #1150407high
Version 2.4.1-1 of mutt is marked for autoremoval from testing on Sun 22 Nov 2026. It is affected by #1150407. The removal of mutt will also cause the removal of (transitive) reverse dependency: muttprofile. You should try to prevent the removal by fixing these RC bugs.
CVE-2026-107570:
heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.
CVE-2026-107570:
heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.
CVE-2026-107570:
heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.
6 issues postponed or untriaged:
CVE-2026-43859:
(needs triaging)
mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest.
CVE-2026-43860:
(needs triaging)
mutt before 2.3.2 sometimes truncates the hash_passwd by one byte for IMAP auth_cram MD5 digest.
CVE-2026-43861:
(needs triaging)
mutt before 2.3.2 does not check for '\0' in url_pct_decode.
CVE-2026-43862:
(needs triaging)
In mutt before 2.3.2, the imap_auth_gss security level is mishandled.
CVE-2026-43863:
(needs triaging)
mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.
CVE-2026-43864:
(needs triaging)
mutt before 2.3.2 has a show_sig_summary NULL pointer dereference.
debian/patches: 13 patches to forward upstream
low
Among the 14 debian patches
available in version 2.4.1-1 of the package,
we noticed the following issues:
13 patches
where the metadata indicates that the patch has not yet been forwarded
upstream. You should either forward the patch upstream or update the
metadata to document its real status.
Standards version of the package is outdated.
wishlist
The package should be updated to follow the last version of Debian Policy
(Standards-Version 4.7.4 instead of
4.7.0).
![[bug history graph]](https://qa.debian.org/data/bts/graphs/m/mutt.png){kind=link}