CVE-2017-17688: Apple Mail

Medium severity, CVSS 5.9. EPSS: 5.5% chance of exploitation in the next 30 days.

The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification

Affected products

• Apple Mail: affected versions not specified
• Bloop Airmail: affected versions not specified
• Emclient Emclient: affected versions not specified
• Flipdogsolutions Maildroid: affected versions not specified
• Freron Mailmate: affected versions not specified
• Horde Horde Imp: affected versions not specified
• Microsoft Outlook: version 2007 only
• Mozilla Thunderbird: affected versions not specified
• Postbox-Inc Postbox: affected versions not specified
• r2mail2 r2mail2: affected versions not specified
• Roundcube Webmail: affected versions not specified

Published 2018-05-16. Last modified 2026-06-17.