CVE-2025-11468

Folding email comments of unfoldable characters doesn't preserve parenthesis

Medium · published January 20, 2026

CVSS v4.0
5.7
EPSS
1%
Percentile
48.8
In the wild
Unconfirmed
What it is

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.

The record
Technical detail
CVSS v4.0
5.7 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00616 · 48.8th percentile
Published
2026-01-20T21:09Z
EPSS history
Timeline
  • 20 JAN 21:09Z
    Folding email comments of unfoldable characters doesn't preserve parenthesis
    cvelistv5