CVE-2024-49393
mutt: neomutt: To and Cc email header fields are not protected by cryptographic signing
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · November 11, 2024
Updated · June 26, 2026
Description
In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 6.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
CWE-347 · Improper Verification of Cryptographic Signature