A heap out-of-bounds (OOB) write vulnerability exists in the mutt email client in the function convert_file_from_to() triggered by a crafted Content-Type header. This flaw allows an attacker to cause an OOB write when an email is used as a template. The issue affects versions prior to 2.2.12-5.oe2403sp3 and has been assigned CVE-2026-107570. The vulnerability has a low severity score and requires local access with high attack complexity and user interaction. A patch is available in version 2.2.12-5.oe2403sp3.