UBUNTU-CVE-2026-107570
- Source
- https://ubuntu.com/security/CVE-2026-107570
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-107570.json
- JSON Data
- https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-107570
- Upstream
- Published
- 2026-10-12T00:00:00Z
- Modified
- 2026-10-13T15:17:02Z
- Severity
-
- 2.5 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
- 2.5 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
- Ubuntu - medium
- Summary
- [none]
- Details
-
heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.
- References
-
- https://ubuntu.com/security/CVE-2026-107570
- https://www.cve.org/CVERecord?id=CVE-2026-107570
- gitlab.com/muttmua/mutt
- github.com/cveproject/cvelistv5/tree/main/cves/2026/107xxx/cve-2026-107570.json
- gitlab.com/muttmua/mutt/-/work_items/533
- nvd.nist.gov/vuln/detail/cve-2026-107570
- gitlab.com/muttmua/mutt/-/commit/7752d93f26f8f1384905fad874afff5abb0f3e54
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150407
- security-tracker.debian.org/tracker/cve-2026-107570
- www.openwall.com/lists/oss-security/2026/10/09/21
Affected packages
Ubuntu:20.04:LTS
mutt
Package
- Name
- mutt
- Purl
- pkg:deb/ubuntu/mutt?arch=source&distro=focal
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
1.*
1.10.1-2.1
1.12.2-1
1.12.2-2
1.13.0-1
1.13.2-1
1.13.2-1ubuntu0.1
1.13.2-1ubuntu0.2
1.13.2-1ubuntu0.3
1.13.2-1ubuntu0.4
1.13.2-1ubuntu0.5
1.13.2-1ubuntu0.6
Ecosystem specific
{
"binaries": [
{
"binary_name": "mutt",
"binary_version": "1.13.2-1ubuntu0.6"
}
],
"priority_reason": "Heap out-of-bounds write in mutt requires a user to use a crafted email as a template, so exploitation needs local interaction and is not remotely reachable by default in Ubuntu deployments."
}Ubuntu:22.04:LTS
mutt
Package
- Name
- mutt
- Purl
- pkg:deb/ubuntu/mutt?arch=source&distro=jammy
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
2.*
2.0.5-4.1build1
2.1.3-1
2.1.4-1
2.1.4-1build1
2.1.4-1ubuntu1.1
2.1.4-1ubuntu1.2
Ecosystem specific
{
"binaries": [
{
"binary_name": "mutt",
"binary_version": "2.1.4-1ubuntu1.2"
}
],
"priority_reason": "Heap out-of-bounds write in mutt requires a user to use a crafted email as a template, so exploitation needs local interaction and is not remotely reachable by default in Ubuntu deployments."
}Ubuntu:24.04:LTS
mutt
Package
- Name
- mutt
- Purl
- pkg:deb/ubuntu/mutt?arch=source&distro=noble
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
2.*
2.2.9-1
2.2.9-1ubuntu0.23.10.1
2.2.12-0.1
2.2.12-0.1build2
2.2.12-0.1build3
2.2.12-0.1build4
Ecosystem specific
{
"binaries": [
{
"binary_name": "mutt",
"binary_version": "2.2.12-0.1build4"
}
],
"priority_reason": "Heap out-of-bounds write in mutt requires a user to use a crafted email as a template, so exploitation needs local interaction and is not remotely reachable by default in Ubuntu deployments."
}Ubuntu:26.04:LTS
mutt
Package
- Name
- mutt
- Purl
- pkg:deb/ubuntu/mutt?arch=source&distro=resolute
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Ecosystem specific
{
"binaries": [
{
"binary_name": "mutt",
"binary_version": "2.2.13-1build2"
}
],
"priority_reason": "Heap out-of-bounds write in mutt requires a user to use a crafted email as a template, so exploitation needs local interaction and is not remotely reachable by default in Ubuntu deployments."
}Ubuntu:Pro:16.04:LTS
mutt
Package
- Name
- mutt
- Purl
- pkg:deb/ubuntu/mutt?arch=source&distro=esm-infra%2Fxenial
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
1.*
1.5.23-3.1ubuntu1
1.5.23-3.1ubuntu2
1.5.24-1
1.5.24-1build1
1.5.24-1ubuntu0.1
1.5.24-1ubuntu0.2
1.5.24-1ubuntu0.3
1.5.24-1ubuntu0.4
1.5.24-1ubuntu0.5
1.5.24-1ubuntu0.6
1.5.24-1ubuntu0.6+esm2
1.5.24-1ubuntu0.6+esm3
Ecosystem specific
{
"binaries": [
{
"binary_name": "mutt",
"binary_version": "1.5.24-1ubuntu0.6+esm3"
},
{
"binary_name": "mutt-patched",
"binary_version": "1.5.24-1ubuntu0.6+esm3"
}
],
"priority_reason": "Heap out-of-bounds write in mutt requires a user to use a crafted email as a template, so exploitation needs local interaction and is not remotely reachable by default in Ubuntu deployments."
}Ubuntu:Pro:18.04:LTS
mutt
Package
- Name
- mutt
- Purl
- pkg:deb/ubuntu/mutt?arch=source&distro=esm-infra%2Fbionic
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
1.*
1.8.3+neomutt20170609-2build1
1.9.1-2
1.9.1-3
1.9.1-4
1.9.1-5
1.9.2-1
1.9.3-1
1.9.4-2
1.9.4-3
1.9.4-3ubuntu0.1
1.9.4-3ubuntu0.2
1.9.4-3ubuntu0.3
1.9.4-3ubuntu0.4
1.9.4-3ubuntu0.5
1.9.4-3ubuntu0.6
1.9.4-3ubuntu0.6+esm1
Ecosystem specific
{
"binaries": [
{
"binary_name": "mutt",
"binary_version": "1.9.4-3ubuntu0.6+esm1"
}
],
"priority_reason": "Heap out-of-bounds write in mutt requires a user to use a crafted email as a template, so exploitation needs local interaction and is not remotely reachable by default in Ubuntu deployments."
}