The vulnerability CVE-2024-49393 affects the neomutt and mutt email clients by failing to cryptographically verify the To and Cc email headers. Because these headers are not signed, an attacker capable of intercepting a message can alter the recipient fields to include themselves. This undermines message confidentiality by allowing unauthorized recipients to receive the email content. The vulnerability does not affect message integrity or availability directly but compromises confidentiality. There is no explicit patch or remediation information provided in the vendor advisory. The CVSS vector indicates the attack requires network access with high attack complexity and no privileges or user interaction, impacting confidentiality with no impact on integrity or availability.

An attacker who can intercept email messages can modify the To and Cc headers to add themselves as recipients, thereby gaining unauthorized access to the message content. This compromises the confidentiality of the email communications. There is no indication that message integrity or availability is affected.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2024-49393 for current remediation guidance. Until a fix is available, users should be aware of the risk of interception and modification of email recipient headers when using neomutt or mutt. Consider using additional transport-level protections such as end-to-end encryption or secure channels to mitigate interception risks.