Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1008
_____________________________________________________________________

DATE                : 12/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Mutt versions prior to 2.4.3.

====================================================================
https://marc.info/?l=mutt-users&m=179154210212456&w=2
_____________________________________________________________________

Hello Mutt Users,

I've just released version 2.4.3.  Instructions for downloading are 
available at <http://www.mutt.org/download.html>, or the tarball can be 
directly downloaded from <http://ftp.mutt.org/pub/mutt/>.  Please take 
the time to verify the signature file against my public key[1].

This release fixes two bugs.  One of them is for CVE-2026-107570, fixing 
an OOB heap write.  This is triggered by a specially crafted 
Content-Header line in an email that is used as a template for a new 
email, via <resend-message>.  Thanks to Calif.io, in collaboration with 
Anthropic for sending me a detailed write up and suggested patch.

The full set of changes are:

7752d93f  Fix OOB heap write in convert_file_from_to().
4364e5b0  Fix mutt_signed_handler() goodsig setting.

Thanks to everyone who for reporting issues, generated patches, reviewed 
code, helped test, and provided feedback on the mailing list.

-Kevin

[1]
My public key is available at:
    - my personal website: https://8t8.us/configs/80316BDA.asc.pubkey
    - the mutt website: http://www.mutt.org/keys/kevin.key
    - The keys.openpgp.org network
      https://keys.openpgp.org/vks/v1/by-fingerprint/8975A9B33AA37910385C5308ADEF768480316BDA

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================