Mutt 2.4.3 ships two security fixes, closing a heap overflow in the charset converter
Mutt, the terminal email client that still refuses to die, released version 2.4.3 today. The update is small by intent: two commits, both bug fixes. But one of them closes a genuine heap overflow that could, in theory, escalate to arbitrary code execution.
Mutt is a Mail User Agent for Unix-like systems. Michael Elkins wrote it in 1995, and Kevin J. McCarthy maintains it today. The project keeps a delightfully modest slogan: "All mail clients suck. This one just sucks less." That attitude suits the software. Mutt runs entirely inside a terminal, answers to keyboard shortcuts, and does the fundamentals well, mbox and Maildir, POP3, IMAP, SMTP, MIME, plus integrated PGP and S/MIME. You write messages in whatever editor you prefer, because Mutt doesn't ship its own.
The reason security researchers gravitate toward Mutt is largely what it doesn't contain. No embedded browser engine. No JavaScript interpreter. That keeps the attack surface tiny, which is a good thing for exactly one reason. When a bug does turn up, it matters more. A parsing flaw in a client that spends its day handling untrusted headers and bodies is never a minor nuisance.
That is really the story behind 2.4.3. It patches CVE-2026-107570, an out-of-bounds heap write, alongside a second quirk that could make Mutt flag a message as authentically signed when it was not.
What actually broke
CVE-2026-107570 lives inside convert_file_from_to(), a function that translates message content between character encodings. It runs in two passes. First it counts how many charsets it will need. Then it allocates memory and copies the charsets over.
The problem is that the second pass doesn't perfectly mirror the first. The counter can drift whenever it hits a zero-length charset component — something like ":utf-8", where the leading colon acts as a delimiter and produces an empty segment. The fix simply increments the counter after the zero-length check instead of inside the loop, so both passes end up agreeing.
It's the kind of off-by-one-class bug that's easy to miss and hard to feel.
The catch is that triggering the overflow needs a little effort. You have to take a received message and reuse it as a template for a new one, using the <resend-message> command. Mutt reprocesses the incoming headers when building that resend, and a crafted Content-Header line can push the desynchronized counter into an out-of-bounds write of arbitrary length. If you don't use that command, you're probably not in the danger zone.
Calif.io, which reported the flaw, said it found no evidence of exploitation in the wild beyond the write itself. McCarthy, though, was unusually insistent. He advised that all shipping distributions apply the patch — a notable nudge from a maintainer who generally prefers users compile from source.
Here's a detail worth flagging. The disclosure is a compact case study in how modern vulnerability research now often runs. Calif.io, a red-team firm known for pairing frontier AI models with human researchers, found the flaw and worked directly with Anthropic. It handed McCarthy a write-up and a suggested patch, and he concurred it was the best approach. Anthropic appears among Calif's listed customers. Firms using AI to poke at open-source code isn't new — the FreeBSD kernel and classic text editors have drawn this attention before — but the pattern keeps growing.
A status flag that lied
The companion fix, commit 4364e5b0 in crypt.c, targets the mutt_signed_handler() routine. The handler failed to reset the goodsig flag in two cases: when crypt_write_signed() fails, and when an unknown signature type turns up. In both, goodsig stayed put at its previous value of 1.
The result is a misleading trust signal. Mutt could stamp a message with the 'S' status flag in the index view — the indicator for a valid, good signature — even when the message was unsigned or its signature couldn't be verified. It isn't a memory bug, but it could steer a user into trusting something they shouldn't. Community member Acts1631 filed the ticket and offered the patch.
Getting it
Mutt 2.4.3 is available as source at the project's site. The tarball sits at ftp.mutt.org, with the signature file right beside it.
If you run NeoMutt, don't lose sleep. This is an upstream release, and the fork tracks these changes, so you benefit once it lands upstream. In the meantime your distro's packaged NeoMutt is what matters.
Mutt's 2.x line has been a steady drip of bug-fix releases this year. 2.4.0 arrived June 19, 2026, adding thread commands and a draft-directory setting. 2.4.1 landed July 4, mostly fixing Alt-key bindings and OpenSSL 4.0 compilation. 2.4.2 followed on August 30. This one is the fourth in the series, and like its siblings it's tagged a "Bug fix release" in the UPDATING file. That's the mood of the current Mutt: maturity over novelty.
Upgrading from 2.4.x is low-risk and preserves your config. Download the tarball, verify the signature, and build. If you'd rather not touch a thing, most modern distros will fold the patch into their next rebuild.
Head here for the full download.
