SUSE Mutt Moderate Loop NULL Pointer Fix Vulnerability 2026-2300

Back Linuxsecurity

SUSE Mutt Moderate Loop NULL Pointer Fix Vulnerability 2026-2300

Linuxsecurity •LinuxSecurity Advisories • June 9, 2026

Share: View original

## This update for mutt fixes the following issues * CVE-2026-43859: `strfcpy` used instead of `memcpy` for the IMAP `auth_cram` MD5 digest (bsc#1263897). * CVE-2026-43860: truncation of `hash_passwd` by one byte for IMAP `auth_cram` MD5 digest (bsc#1263896). * CVE-2026-43861: missing check for `\0` in `url_pct_decode` (bsc#1263895). * CVE-2026-43862: mishandling of the `imap_auth_gss` security level (bsc#1263894). * CVE-2026-43863: infinite loop in `data_object_to_stream` in `crypt-gpgme.c` (bsc#1263893). * CVE-2026-43864: NULL pointer dereference in function `show_sig_summary` (bsc#1263892). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

## This update for mutt fixes the following issues * CVE-2026-43859: `strfcpy` used instead of `memcpy` for the IMAP `auth_cram` MD5 digest (bsc#1263897). * CVE-2026-43860: truncation of `hash_passwd` by one byte for IMAP `auth_cram` MD5 digest (bsc#1263896). * CVE-2026-43861: missing check for `\0` in `url_pct_decode` (bsc#1263895). * CVE-2026-43862: mishandling of the `imap_auth_gss` security level (bsc#1263894). * CVE-2026-43863: infinite loop in `data_object_to_stream` in `crypt-gpgme.c` (bsc#1263893). * CVE-2026-43864: NULL pointer dereference in function `show_sig_summary` (bsc#1263892). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

* CVE-2026-43859 ( SUSE ): 6.3

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

* CVE-2026-43859 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

* CVE-2026-43859 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

* CVE-2026-43860 ( SUSE ): 6.3

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

* CVE-2026-43860 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

* CVE-2026-43860 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

* CVE-2026-43861 ( SUSE ): 6.9

Announcement ID: SUSE-SU-2026:2300-1 Release Date: 2026-06-08T13:54:59Z Rating: moderate

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities in Mutt Affecting SUSE and openSUSE Users SUSE and openSUSE have released security updates for the Mutt email client addressing multiple vulnerabilities. The updates fix issues including a NULL pointer dereference, an infinite loop, and improper handling of IMAP authentication. Key vulnerabilities include CVE-2026-43859 through CVE-2026-43864, all published on 2026-05-04. These vulnerabilities could potentially lead to denial of service or unauthorized access if exploited. Users are advised to apply the patches using recommended installation methods like YaST or zypper. The updates were released on 2026-06-08, and both advisories emphasize the importance of immediate patching. The vulnerabilities have been rated as moderate in severity. 2 sources 46

Extracted Entities

Companies (1)

CVEs (6)

CVE-2026-43859 CVE-2026-43860 CVE-2026-43861 CVE-2026-43862 CVE-2026-43863 CVE-2026-43864

CWE Weaknesses (1)

Cwe-476 - NULL Pointer Dereference

Platforms (1)