The vulnerability CVE-2024-49395 affects the mutt and neomutt email clients. It arises because PGP encryption is performed without the --hidden-recipient mode, which is intended to conceal Bcc recipients. As a result, the Bcc header field may be inferred from the recipients' information, potentially exposing sensitive metadata about email recipients. The CVSS 3.1 base score is 5.3 (medium), with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact. No vendor advisory details on patch availability or affected versions are provided beyond the Red Hat advisory link.

The impact is limited to confidentiality, specifically the potential exposure of Bcc recipients through metadata inference. There is no impact on integrity or availability. This could lead to unintended disclosure of recipient information in emails encrypted with PGP using mutt or neomutt without the hidden-recipient mode.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2024-49395 for current remediation guidance. Until a fix is available, users should be aware of the potential metadata leakage when using PGP encryption in mutt or neomutt and consider alternative methods or configurations to protect Bcc recipient privacy.