CVE-2024-49394: mutt

CVSS: 5.3v3.1MediumModified

AliasesUBUNTU-CVE-2024-49394DEBIAN-CVE-2024-49394

Published 12-11-2024Last modified 26-06-2026

Vulnerability summary

CVE-2024-49394 is a medium (CVSS 5.3) vulnerability in mutt. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24% of scored vulnerabilities.

Overall risk

21/100

0100

Low · default modelHow is this calculated?

CVSS score

5.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.33%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 2

MGASA-2025-0070 OPENSUSE-SU-2024:14527-1 USN-7204-1

Timeline

12-11-2024
PublishedVulnerability first disclosed.
26-06-2026
Last modifiedVulnerability information updated.

Description

In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.

CVSS metrics

4 scores · 4 sources · 1 version

v3.15.3

EPSS trend

Probability

0.33%

Chance of exploitation in the next 30 days

Percentile

24%

Versus all other CVEs

30-day change

0.00 pp

From 0.33% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.33%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-347Improper Verification of Cryptographic SignatureThe product does not verify, or incorrectly verifies, the cryptographic signature for data.

Affected systems

Debian2 products

muttAll versions (No fix recorded)
neomuttAll versions (No fix recorded) | < 20241002+dfsg-1

Ubuntu2 products

muttAll versions (No fix recorded)
neomuttAll versions (No fix recorded) | < 20191207+dfsg.1-1.1ubuntu0.1~esm1 | < 20211029+dfsg1-1ubuntu0.1~esm1 | < 20231103+dfsg1-1ubuntu0.1~esm1

Mutt1 product