CVE-2026-43859: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-43859 is a low-severity vulnerability in the mutt email client affecting versions before 2.3.2, where the IMAP CRAM-MD5 authentication handler incorrectly uses strfcpy() instead of memcpy() when processing the MD5 digest of a user's password. This flaw can cause the digest to be truncated if it contains a null byte (\0), and also truncates the hash by one byte unconditionally due to an off-by-one in the size argument. The vulnerability was published on May 4, 2026, and carries a CVSS v3.1 base score of 3.7 (Low) (GitHub Advisory, Feedly).

The root cause is classified as CWE-158 (Improper Neutralization of Null Byte or NUL Character). In imap/auth_cram.c, the hmac_md5() function handles passwords longer than MD5_BLOCK_LEN (64 bytes) by hashing them with MD5 first. The resulting raw binary digest was then copied using strfcpy() — a string copy function that stops at null bytes — instead of memcpy(), which copies a fixed number of bytes regardless of content. This means any null byte in the 16-byte MD5 digest would silently truncate the secret used in CRAM-MD5 authentication, and the strfcpy call also passed MD5_DIGEST_LEN as the size rather than MD5_DIGEST_LEN + 1, causing an additional one-byte truncation. The fix replaces strfcpy with memcpy in a single-line change (mutt commit, GitHub Advisory).

Successful exploitation could allow a network-based attacker to manipulate the integrity of the CRAM-MD5 authentication digest, potentially enabling unauthorized access to email accounts that use IMAP with CRAM-MD5 authentication. The impact is limited to integrity (Low), with no confidentiality or availability impact assessed. Practical exploitation is further constrained by the requirement that the victim's password must be longer than 64 bytes — an uncommon configuration — and that CRAM-MD5 itself is rarely used in modern deployments (GitHub Advisory, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The EPSS score is approximately 0.029–0.041%, placing it in the 13th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. High attack complexity — requiring passwords exceeding 64 bytes and use of the deprecated CRAM-MD5 authentication mechanism — significantly limits real-world risk.

Users should upgrade mutt to version 2.3.2 or later, which replaces the erroneous strfcpy() call with memcpy() in imap/auth_cram.c (mutt commit). SUSE has issued a security update (SUSE-SU-2026:2301-1) for affected distributions (SUSE Advisory). As a workaround, organizations can disable CRAM-MD5 authentication in their IMAP configuration or enforce password lengths of 64 bytes or fewer, though upgrading is the recommended long-term solution.

SUSE issued a security advisory (SUSE-SU-2026:2301-1) and openSUSE published a corresponding security announcement addressing this vulnerability in mutt (SUSE Advisory, openSUSE). Tenable published a Nessus detection plugin (ID 312033) for the vulnerability. General community reaction has been muted given the low severity, narrow exploitation conditions, and the declining use of CRAM-MD5 authentication.