CVE-2021-32055 Memory corruption in n/a

Critical 9.1 Published 5 May 2021 Updated 3 Aug 2024

An out-of-bounds read in Mutt's IMAP QRESYNC feature can cause crashes or leak memory when processing malformed sequence sets.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-32055?

CVE-2021-32055 is a critical memory corruption vulnerability in n/a, published on 5 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync issue in which imap/util.c has an out-of-bounds read in situations where an IMAP sequence set ends with a comma. NOTE: the $imap_qresync setting for QRESYNC is not enabled by default.

Weakness: CWE-125

Which versions are affected by CVE-2021-32055?

It affects 2 products.

Linux distribution packages (1)

neomutt openSUSE:Tumbleweed All versions 20211029-1.1

Products include Mutt Mutt, Neomutt Neomutt.

How do I fix CVE-2021-32055?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-32055 being exploited?

There is no known exploitation of CVE-2021-32055 in the wild and no public exploit code.

Sources

Also known as AZL-7292, DEBIAN-CVE-2021-32055, GHSA-vchg-jq4g-j9q7, UBUNTU-CVE-2021-32055, openSUSE-SU-2024:11719-1.