MIME::Head versions from 5.518 up to but not including 5.521 for Perl improperly decode multipart boundaries that are partly RFC 2047 encoded without marking the parse as ambiguous. This allows a remote sender to craft a multipart boundary that bypasses filters relying on ambiguous_content() detection, potentially hiding attachments from such filters while still displaying them in the recipient's mail client.