CVE-2026-43861: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-43861 is a null byte injection vulnerability in the mutt email client affecting all versions before 2.3.2. The flaw exists in the url_pct_decode() function, which fails to check for embedded null bytes (\0) when percent-decoding URLs. It was published on May 4, 2026, with a patch available in mutt 2.3.2. The vulnerability carries a CVSS v3.1 base score of 3.7 (Low) (GitHub Advisory, Feedly).

The root cause is classified as CWE-158 (Improper Neutralization of Null Byte or NUL Character). In url.c, the url_pct_decode() function processes percent-encoded URL sequences (e.g., %XX) but did not previously reject the %00 sequence, which decodes to a null byte. The fix adds a condition (hexval(s[1]) > 0 || hexval(s[2]) > 0) to explicitly reject %00 as an invalid character in a URL, preventing null bytes from being written into the decoded output buffer. The attack vector is network-based with high complexity, requiring no privileges or user interaction, and is triggered by processing a specially crafted URL embedded in an email (GitHub Commit, GitHub Advisory). The vulnerability was reported by evilrabbit@tutamail.com (GitHub Commit).

Successful exploitation could allow an attacker to manipulate URL handling behavior in mutt's email processing by crafting URLs containing %00 (null byte) sequences that are interpreted differently than intended after decoding. The primary impact is a low-severity integrity violation — there is no confidentiality or availability impact. An attacker could potentially cause mutt to process a truncated or altered URL, leading to unexpected behavior such as bypassing URL validation logic or redirecting URL-based actions (GitHub Advisory, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.029–0.041%, placing it in the 13th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Feedly).

Users should upgrade mutt to version 2.3.2 or later, which includes the fix that rejects %00 as an invalid percent-encoded character in url_pct_decode(). SUSE has issued a security update (SUSE-SU-2026:2301-1) for affected distributions (SUSE Advisory). As an interim measure, organizations should consider restricting mutt's processing of URLs from untrusted email sources until patching is complete (Feedly).

SUSE issued a security advisory (SUSE-SU-2026:2301-1) addressing this vulnerability in their mutt packages, and openSUSE published a corresponding security announcement (SUSE Advisory, openSUSE Announce). Tenable published a Nessus plugin (ID 312035) to detect vulnerable mutt installations. Overall community reaction has been muted given the low severity rating and absence of active exploitation.