Hi, The following vulnerability was published for mutt. CVE-2026-107570[0]: | heap OOB write in convert_file_from_to() via a crafted Content-Type | header allows attacker to OOB write when email is used as a | template. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-107570 https://www.cve.org/CVERecord?id=CVE-2026-107570 [1] https://gitlab.com/muttmua/mutt/-/work_items/533 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
We believe that the bug you reported is fixed in the latest version of mutt, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1150407@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Moritz Mühlenhoff <jmm@debian.org> (supplier of updated mutt package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) Format: 1.8 Date: Fri, 09 Oct 2026 20:03:14 +0200 Source: mutt Architecture: source Version: 2.2.13-1+deb13u2 Distribution: trixie-security Urgency: medium Maintainer: Mutt maintainers <mutt@packages.debian.org> Changed-By: Moritz Mühlenhoff <jmm@debian.org> Closes: 1150407 Changes: mutt (2.2.13-1+deb13u2) trixie-security; urgency=medium . * CVE-2026-107570 (Closes: #1150407) Checksums-Sha1: 4bc957a01dc06df952308d1319ad713bae4e3b4b 2320 mutt_2.2.13-1+deb13u2.dsc 957df1684a46fe1b99adff96b8fe1d87b49aeffd 5539130 mutt_2.2.13.orig.tar.gz b4e68589d11261d3303f1f75135815954d521ee4 833 mutt_2.2.13.orig.tar.gz.asc 13619d7730f2a83178b230635a3075712d30c682 63856 mutt_2.2.13-1+deb13u2.debian.tar.xz d53191f12314d02f63581d4a916d77ee142f3203 8797 mutt_2.2.13-1+deb13u2_amd64.buildinfo Checksums-Sha256: fcd0e7c7358a9767c24fc81ffc7b18aac74ab4761f93e5402bfc05d43c1d3a97 2320 mutt_2.2.13-1+deb13u2.dsc eb23faddc1cc97d867693f3a4a9f30949ad93765ad5b6fdae2797a4001c58efb 5539130 mutt_2.2.13.orig.tar.gz 325a2d86a1bc50f3b2007678a9ac744893beea88c934d5e11d77a1e62510df63 833 mutt_2.2.13.orig.tar.gz.asc 82ba323c6a64b9bd52f2adac36f58a118cbf74422526621a3f4a8ef216e75af0 63856 mutt_2.2.13-1+deb13u2.debian.tar.xz c729759a6ded2e091e2f56209456b818f392ccb00f27bfbadb6b6905a005f8d7 8797 mutt_2.2.13-1+deb13u2_amd64.buildinfo Files: 9d6ae337e2de94cb3160b573387a0868 2320 mail optional mutt_2.2.13-1+deb13u2.dsc 0d33c808d5556c283c01542c7730ccbd 5539130 mail optional mutt_2.2.13.orig.tar.gz 7db9e9e896df59849ef0442e4ea4b2b4 833 mail optional mutt_2.2.13.orig.tar.gz.asc c915bac5242670d661f9ce95b7c6cb22 63856 mail optional mutt_2.2.13-1+deb13u2.debian.tar.xz 9b6037531b418dbbe6755898d721fc14 8797 mail optional mutt_2.2.13-1+deb13u2_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmrJLe4ACgkQEMKTtsN8 TjaLkxAAtSG95Qh7+gu/0fjlNQp0YskMyEOqID4FHBcY2fKlOVKfy1d4sGqRRTVJ RNcpUaCIuFJla3RMo0VgEOqEkpegtPZ1sBYlW3SgchgpKiVnZx45d37f+pqan1A+ D4iSmsc/AONZBF7+snFiqxznkrVdg5icxHXpRtKQIu5folfID2z4he1fTVkEORSF hPYqpk65fp4lvnN6avRkhJGBbqGnTYKF3d0joB5o1MwhdxSDw8/lSG0J0YoaeXXv mOwF7k74cxIch92XVl53w34GWMa6IFZ9HmBnpiN8LPLKBFwjifjly7DZ/cezWwbE 1o90FiFmoK7Cnupzymvjyok26X9jpdG3rXnC/dDH2lVhuYGMFKgGNXza/vLuhMia wEbufC2BGYxru/gXBmKCgXJMpEcSwrPfOt4U1p9Z+Z1G0wBXp+NggMfS3Pc9zQN5 m3QB2zZmGRUj6smk2IW4R6gb8x76O9qJ3ZKdRXXC1SNIE4etWTJQiQxFITH1bMal ZxcTd7jDtXuL4mnlfq3w7jxgd+8e/Eww00eZgEen26pyCZrT7WL58iC0T7/Ehbgm 0Obwza0+EVH0qAH0QfYoh0eIRYd3oeSlD17r3TvlLg5h6kikf+tEFk4ze2cjlmKd +kaBQo6oihGCKogIqZ7Ao59mP5FsmnFp3Vo2P0Azv4I/wBq4PBU= =ioBj -----END PGP SIGNATURE-----
Dear maintainer, I've prepared an NMU for mutt (versioned as 2.4.1-1.1) and uploaded it to DELAYED/2. Please feel free to tell me if I should cancel it. Regards, Salvatore
We believe that the bug you reported is fixed in the latest version of
mutt, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1150407@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated mutt package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 25 Oct 2026 15:12:45 +0100
Source: mutt
Architecture: source
Version: 2.4.1-1.1
Distribution: unstable
Urgency: medium
Maintainer: Mutt maintainers <mutt@packages.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 1150407
Changes:
mutt (2.4.1-1.1) unstable; urgency=medium
.
* Non-maintainer upload.
* Fix OOB heap write in convert_file_from_to(). (CVE-2026-107570)
(Closes: #1150407)
Checksums-Sha1:
4916e123828d71ecc2742be7296eea7be337ee5e 2452 mutt_2.4.1-1.1.dsc
a7a3388a1f6d8db0fa84e253c6e566d06e4e2305 57368 mutt_2.4.1-1.1.debian.tar.xz
2d5b05cdb81f61b85bfb8c8fc2372ea852366c1b 5529 mutt_2.4.1-1.1_source.buildinfo
Checksums-Sha256:
8f0761a7a5edcb81977c82dbaec4d5f21df0c918ce42e13589c4e5614d6b7b38 2452 mutt_2.4.1-1.1.dsc
c4db5f6c711da9ae8ac49723aa8f7d3690adbf3afb9dbf30c38b5e96778fa332 57368 mutt_2.4.1-1.1.debian.tar.xz
aefdd333e36ddfa60de363989440ba5324214e7b5fbaf1b1183e6dc486e68f95 5529 mutt_2.4.1-1.1_source.buildinfo
Files:
470828a4126f87c75d5442f83ac2175e 2452 mail optional mutt_2.4.1-1.1.dsc
a69ec24332ce7de2a1df35263cfa6f74 57368 mail optional mutt_2.4.1-1.1.debian.tar.xz
4d5acd7ca9fc0af61f3156a2a1337a30 5529 mail optional mutt_2.4.1-1.1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmreEjZfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89E7pIP/RtxfUq1KT/kLH0GvvzBfg9kkR56K7Le
ftTSIOHr75c7/Lm2T6ITKa41rslXkshLnmMn12w70umI9a2veH1yocqO0aTmzoUF
HUOwiMCu80mCboiJP/JtGWYSh41FXDsvNWhlU/6/Iq12RvHNzmsfFTm2OdewJqpZ
Ger2Jt+/n5PqIzudK1RiI3e07PWL8z7o49YePo2NY02Oe8blm/Eyv1uzvM+mBCuV
9r7YwOWfULekojNkGFJDIeWsWc/SvkaKO/ScZ7RrPQcAVgt2dQDlXd/I2a82tk3v
coSS66ikEFhOd9CsImT4B9XKeVS2Yoy+1LvxuGxRtQXnUvKIUHKHRttv5MxIHZPW
9uR4vehUut75aE6G4iI5oFwuiMm6HvGEIEXbRFfTtvV1HSjTsjwqa2Mlxc9o3qg0
wFixbMbXNoTOJwDYnF8UjaLdbR5StKuc3YHsCPjSabcu25Pd1C5w4Dh5d38fqdrq
NCgOSiZYXV26lPe96UTzm5S8fn7dhOBUXrBEts4Zt5IkPGiGwoIuSsu3Rk5rwJMy
L/xEvP/tsI5Rqk/3M0dFNTZlYpPpVHsTO9JyqDaiPQ/IyHkTfTPmco80Rbxd3/Fa
ka9viR+19KUDxBLXdYZP/eH50vMrkOcCJ8CtGbXQrAc1ffeiflKydnT/BQsBNXT+
OhmuBzLQ9kz3
=2Qt0
-----END PGP SIGNATURE-----