CVE-2024-49394
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.
Risk Assessment
The risk involves the possibility of a spoofing attack where an attacker can impersonate the original sender, potentially leading to fraud or identity theft in email communication.
Recommendation
It is recommended to update mutt and neomutt to the latest version that includes a fix to protect the In-Reply-To field from unauthorized use.
Original NVD description (English source)
In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.