CVE-2024-49393
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.
Risk Assessment
The risk is that an attacker can intercept a digitally signed message and modify its headers to become a recipient, leading to leakage of confidential information to an unauthorized person.
Recommendation
It is recommended to update neomutt and mutt to a version where this vulnerability is fixed, and consider additional encryption of message content to protect confidentiality.
Original NVD description (English source)
In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.