CVE-2003-0167: Mutt

High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days.

Multiple off-by-one buffer overflows in the IMAP capability for Mutt 1.3.28 and earlier, and Balsa 1.2.4 and earlier, allow a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a specially crafted mail folder, a different vulnerability than CVE-2003-0140.

Affected products

• Mutt Mutt: version 1.3.12 only; version 1.3.12.1 only; version 1.3.16 only; version 1.3.17 only; version 1.3.22 only; version 1.3.24 only; …

Published 2003-04-02. Last modified 2026-06-16.