CVE-2021-32055: 
NixOS vulnerability analysis and mitigation

Mutt 1.11.0 through 2.0.x before 2.0.7 and NeoMutt (2019-10-25 through 2021-05-04) contain a vulnerability related to the $imap_qresync feature. The issue involves an out-of-bounds read in the imap/util.c file when an IMAP sequence set ends with a comma. Importantly, the vulnerable $imap_qresync setting is not enabled by default as it is considered an experimental feature (CVE Mitre, Ubuntu Security).

The vulnerability stems from an implementation flaw in the IMAP sequence set handling where if the seqset ended with a comma, the substr_end marker would be positioned just before the trailing null character. In subsequent calls, the loop designed to skip the marker would iterate beyond the end of the string. The issue was addressed by modifying how the substr_end marker is placed and immediately skipped (GitHub Commit, GitLab Commit). The vulnerability has received a CVSS 3 Severity Score of 9.1 (Critical) (Ubuntu Security).

The vulnerability could potentially lead to a Denial of Service condition when a user connects to a malicious IMAP server. Additionally, if the memory accessible by the attacker can be effectively controlled, there might be other unspecified impacts (Gentoo Security).

The vulnerability requires a user to connect to a malicious IMAP server and have the experimental $imap_qresync feature enabled, which is disabled by default. This significantly reduces the practical exploitability of the vulnerability (CVE Mitre).

The vulnerability has been fixed in Mutt version 2.0.7 and NeoMutt version 20210205-r1. Users are advised to upgrade to these or later versions. For Mutt users who cannot immediately upgrade, the primary mitigation is that the vulnerable $imap_qresync feature is disabled by default (Mutt Announce, Gentoo Security).