CVE-2026-107570CWE-823

CVE-2026-107570

Low · published October 8, 2026

CVSS v3.1
2.5
EPSS
0%
Percentile
2.6
In the wild
Unconfirmed
What it is

heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.

The record
Technical detail
CVSS v3.1
2.5 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00133 · 2.6th percentile
Weakness
CWE-823 · Use of Out-of-range Pointer Offset
Published
2026-10-08T16:17Z
References (2)
https://gitlab.com/muttmua/mutt/-/work_items/533 · [email protected]http://www.openwall.com/lists/oss-security/2026/10/09/21 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 10 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 08 OCT 11:33Z
    Use of Out-of-range Pointer Offset in mutt
    cvelistv5
  • 08 OCT 11:33Z
    Use of Out-of-range Pointer Offset in mutt
    cvelistv5