Description
In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.
Published: 2024-11-12
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-43420 In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.
Ubuntu USN Ubuntu USN USN-7204-1 NeoMutt vulnerabilities
History

Fri, 26 Jun 2026 04:15:00 +0200

Type Values Removed Values Added
References

Wed, 16 Jul 2025 15:45:00 +0200

Type Values Removed Values Added
Metrics epss

{'score': 0.00035}

 epss

{'score': 0.00036}

Wed, 16 Jul 2025 14:00:00 +0200

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N'}

Sat, 05 Jul 2025 07:00:00 +0200

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10

Thu, 14 Nov 2024 16:00:00 +0100

Type Values Removed Values Added
First Time appeared Mutt
Mutt mutt
Neomutt
Neomutt neomutt
CPEs cpe:2.3:a:mutt:mutt:-:*:*:*:*:*:*:*
cpe:2.3:a:neomutt:neomutt:-:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:-:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Vendors & Products Mutt
Mutt mutt
Neomutt
Neomutt neomutt

Tue, 12 Nov 2024 16:15:00 +0100

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 12 Nov 2024 03:15:00 +0100

Type Values Removed Values Added
Title mutt: neomutt: To and Cc email header fields are not protected by cryptographic signing Mutt: neomutt: to and cc email header fields are not protected by cryptographic signing
First Time appeared Redhat
Redhat enterprise Linux
CPEs cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References

Tue, 12 Nov 2024 02:45:00 +0100

Type Values Removed Values Added
Description In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.
Title mutt: neomutt: To and Cc email header fields are not protected by cryptographic signing
Weaknesses CWE-347
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

threat_severity

Moderate

Subscriptions

Mutt Mutt
Neomutt Neomutt
Redhat Enterprise Linux
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-06-26T01:22:10.365Z

Reserved: 2024-10-14T17:56:03.767Z

Link: CVE-2024-49393

cve-icon Vulnrichment

Updated: 2024-11-12T14:25:42.939Z

cve-icon NVD

Status : Modified

Published: 2024-11-12T02:15:18.443

Modified: 2026-06-26T02:16:50.577

Link: CVE-2024-49393

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-11-11T00:00:00Z

Links: CVE-2024-49393 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-347

    Improper Verification of Cryptographic Signature