First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-43861

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

mutt before 2.3.2 does not check for '\0' in url_pct_decode.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
mutt	mutt	< 2.3.2

References

https://github.com/muttmua/mutt/commit/12f54fe3b61f761c096fe95e95d5e3072af00ed2

Timeline

Published: May 4, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-438623.7In mutt before 2.3.2, the imap_auth_gss security level is mishandled.CVE-2026-438633.7mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.CVE-2026-438642.5mutt before 2.3.2 has a show_sig_summary NULL pointer dereference.CVE-2026-438658.1Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Haze CVE-2026-438667.3Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms() in camel-jms -CVE-2026-438679.8Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata (CVE-2026-438685.3Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are rec CVE-2026-438697.3Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Use CVE-2026-43872.0StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JS CVE-2026-438707.3Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Seq CVE-2026-438717.5Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects A CVE-2026-438725.3Actual is an open-source personal finance application. Prior to version 26.5.0, several endpoints are affected by a path traversal vulnerabi

CVE-2026-43861: Low severity, CVSS 3.7 | Vulnix