This update for mutt fixes six vulnerabilities: CVE-2026-43859 involves using strfcpy instead of memcpy for the IMAP auth_cram MD5 digest, potentially causing incorrect memory handling. CVE-2026-43860 addresses a one-byte truncation of hash_passwd in the same authentication context. CVE-2026-43861 fixes a missing null character check in url_pct_decode, which could lead to improper URL decoding. CVE-2026-43862 corrects mishandling of the imap_auth_gss security level. CVE-2026-43863 resolves an infinite loop in data_object_to_stream within crypt-gpgme.c. CVE-2026-43864 patches a NULL pointer dereference in show_sig_summary. These vulnerabilities affect mutt version 2.2.14-150600.3.6.1 on SUSE Linux for aarch64 and i586 architectures. The fixes are provided by the SUSE Product Security Team.

The vulnerabilities impact the security and stability of mutt's IMAP authentication and cryptographic processing. Issues such as improper memory copying, truncation, missing null checks, and NULL pointer dereferences can lead to potential crashes, denial of service, or incorrect authentication behavior. The infinite loop could cause resource exhaustion. However, no known exploits in the wild have been reported for these issues.

A security update has been released by the SUSE Product Security Team addressing all six vulnerabilities. Users should apply the official patches provided in the mutt package version 2.2.14-150600.3.6.1 for their respective SUSE Linux distributions on aarch64 and i586 architectures. Patch status is confirmed by the vendor advisory SUSE-SU-2026:2301-1. No additional mitigation steps are indicated beyond applying this update.