A vulnerability exists in mutt versions before 2.3.2 where the function url_pct_decode does not properly check for null ('\0') characters. This issue has a CVSS 3.7 score and is rated medium severity. It may lead to limited impact on integrity but does not affect confidentiality or availability. Multiple specific mutt package versions are affected. No known exploits are reported in the wild. No patch or remediation details are provided in the source data.