[UPDATE] [low] mutt: Multiple vulnerabilities

A remote, anonymous attacker can exploit multiple vulnerabilities in mutt to bypass security precautions and cause a denial-of-service condition.

CSIRTS triage

What: Multiple vulnerabilities allow a remote attacker to bypass security precautions and cause a denial-of-service condition.
Who is affected: Deployments of mutt are affected.
Urgency: Remediation is low urgency as exploitation is not currently active and severity is low.
Action: No specific action is required at this time.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch mutt

Get an email when a new mutt advisory drops — max one per day, one-click unsubscribe.

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-438590.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all scored CVEs.
Low exploitation riskCVE-2026-438600.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all scored CVEs.
Low exploitation riskCVE-2026-438610.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all scored CVEs.
Low exploitation riskCVE-2026-438620.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all scored CVEs.
Low exploitation riskCVE-2026-438630.20% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 10% of all scored CVEs.
Low exploitation riskCVE-2026-438640.10% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all scored CVEs.

CVE	CSIRTS overview	External
CVE-2026-43859	coverage & exploitation status	NVD · CVE.org
CVE-2026-43860	coverage & exploitation status	NVD · CVE.org
CVE-2026-43861	coverage & exploitation status	NVD · CVE.org
CVE-2026-43862	coverage & exploitation status	NVD · CVE.org
CVE-2026-43863	coverage & exploitation status	NVD · CVE.org
CVE-2026-43864	coverage & exploitation status	NVD · CVE.org