CVE Catalog
CVE-2024-49395
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk0.30%
21th percentile - higher than 21% of all known CVEs
Summary
In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from the recipients info.
Risk Assessment
The organization risks leaking confidential information about hidden recipients of email messages, which may compromise communication confidentiality and information security policies.
Recommendation
It is recommended to update mutt and neomutt to versions that use the --hidden-recipient mode by default during PGP encryption, or manually configure the client to use this mode.
Original NVD description (English source)
In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from the recipients info.