This security update for mutt addresses six vulnerabilities: CVE-2026-43859 involves the use of strfcpy instead of memcpy for the IMAP auth_cram MD5 digest; CVE-2026-43860 concerns truncation of the hash_passwd by one byte in the same context; CVE-2026-43861 is a missing check for a null terminator in url_pct_decode; CVE-2026-43862 relates to mishandling of the imap_auth_gss security level; CVE-2026-43863 is an infinite loop in data_object_to_stream within crypt-gpgme.c; and CVE-2026-43864 is a NULL pointer dereference in show_sig_summary. These issues were fixed in the SUSE mutt package version 1.10.1-55.33.1 for aarch64 and i586 architectures.

The vulnerabilities could lead to incorrect authentication processing, potential denial of service through infinite loops or crashes due to NULL pointer dereferences, and improper handling of security levels. These issues may affect the reliability and security of IMAP authentication and cryptographic operations in mutt, potentially impacting confidentiality and availability of the email client.

A security update fixing these vulnerabilities has been released by the SUSE Product Security Team. Users should apply the updated mutt package version 1.10.1-55.33.1 for their respective architectures (aarch64, i586) to remediate these issues. No additional mitigation steps are indicated.