Enigmail is an encryption plugin for email clients that integrates OpenPGP functionality to provide end-to-end message confidentiality and authentication, occupying a niche but strategically important role in the secure-communications supply chain. Its vulnerability profile centers on the single Enigmail product and recurs through weakness classes involving cryptographic signature verification, cleartext transmission of sensitive data, and input validation—flaws that can undermine the confidentiality and authenticity guarantees the software is designed to provide. The vendor's disclosures show a moderate tendency to acquire public exploit code, reflecting the security-researcher interest in email-encryption implementations. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Enigmail over time
Signals from CVEs in this vendor scope (14 CVEs).
14 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-12269HIGH Enigmail before 2.0.11 allows PGP signature spoofing: for an inline PGP message, an attacker can cause the product to display a "correctly signed" message indication, but display d | May 21, 2019 | 7.5 | 24 | NO | NO |
CVE-2007-1264MEDIUM Enigmail 0.94.2 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Enigmail from visually distinguishing between signed and unsigned por | Mar 6, 2007 | 5.0 | 24 | NO | YES |
CVE-2017-17848HIGH An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be | Dec 27, 2017 | 7.5 | 23 | NO | NO |
CVE-2017-17847HIGH An issue was discovered in Enigmail before 1.9.9. Signature spoofing is possible because the UI does not properly distinguish between an attachment signature, and a signature that | Dec 27, 2017 | 7.5 | 23 | NO | NO |
CVE-2017-17846HIGH An issue was discovered in Enigmail before 1.9.9. Regular expressions are exploitable for Denial of Service, because of attempts to match arbitrarily long strings, aka TBE-01-003. | Dec 27, 2017 | 7.5 | 23 | NO | NO |
CVE-2019-14664MEDIUM In Enigmail below 2.1, an attacker in possession of PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden us | Aug 5, 2019 | 6.5 | 22 | NO | NO |
CVE-2017-17845HIGH An issue was discovered in Enigmail before 1.9.9. Improper Random Secret Generation occurs because Math.Random() is used by pretty Easy privacy (pEp), aka TBE-01-001. | Dec 27, 2017 | 7.3 | 22 | NO | NO |
CVE-2018-15586MEDIUM Enigmail before 2.0.6 is prone to to OpenPGP signatures being spoofed for arbitrary messages using a PGP/INLINE signature wrapped within a specially crafted multipart HTML email. | Feb 11, 2019 | 6.5 | 21 | NO | NO |
CVE-2018-12019HIGH The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, w | Jun 13, 2018 | 7.5 | 21 | NO | NO |
CVE-2017-17843MEDIUM An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regular expressions are use | Dec 27, 2017 | 5.9 | 20 | NO | NO |
Signals from CVEs in this vendor scope (14 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Enigmail.
Media articles that mention a CVE ID that affects a product developed by Enigmail — matched by CVE ID, not by vendor name.