Mutt is a text-based email client widely deployed across Unix and Linux systems, representing a focused but persistently maintained product serving technical and security-conscious users. Its vulnerability profile skews strongly toward critical-severity outcomes, concentrated in a narrow product line but reflecting the memory-safety challenges inherent to a C-based mail parser handling untrusted message content. The recurring weakness classes—improper input validation, buffer overflows, out-of-bounds writes, and memory-bounds violations—are characteristic of the parsing demands placed on email processing code and have recurred across the vendor's release history. Defenders should apply Mutt updates promptly despite the vendor's niche position, as the product's presence in security operations centers and administratively sensitive systems elevates the impact of parser-level flaws. Current severity and exploitation activity are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Mutt over time
Signals from CVEs in this vendor scope (52 CVEs).
52 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-14359CRITICAL An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They have a buffer overflow via base64 data. | Jul 17, 2018 | 9.8 | 31 | NO | NO |
CVE-2018-14356CRITICAL An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c mishandles a zero-length UID. | Jul 17, 2018 | 9.8 | 31 | NO | NO |
CVE-2018-14354CRITICAL An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the m | Jul 17, 2018 | 9.8 | 31 | NO | NO |
CVE-2018-14350CRITICAL An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long INTERNALDATE field. | Jul 17, 2018 | 9.8 | 31 | NO | NO |
CVE-2018-14362CRITICAL An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c does not forbid characters that may have unsafe interaction with message-cache pathnames, as demo | Jul 17, 2018 | 9.8 | 30 | NO | NO |
CVE-2018-14358CRITICAL An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long RFC822.SIZE field. | Jul 17, 2018 | 9.8 | 30 | NO | NO |
CVE-2018-14357CRITICAL An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the m | Jul 17, 2018 | 9.8 | 30 | NO | NO |
CVE-2018-14353CRITICAL An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap_quote_string in imap/util.c has an integer underflow. | Jul 17, 2018 | 9.8 | 30 | NO | NO |
CVE-2018-14351CRITICAL An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a long IMAP status mailbox literal count size. | Jul 17, 2018 | 9.8 | 30 | NO | NO |
CVE-2018-14349CRITICAL An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a NO response without a message. | Jul 17, 2018 | 9.8 | 30 | NO | NO |
Signals from CVEs in this vendor scope (52 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Mutt.
Media articles that mention a CVE ID that affects a product developed by Mutt — matched by CVE ID, not by vendor name.