CVE-2026-107570: Mutt

Low severity, CVSS 2.5. EPSS: 0.1% chance of exploitation in the next 30 days.

heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.

Affected products

• Mutt Mutt: up to and including 2.4.2

Published 2026-10-08. Last modified 2026-10-10.