CVE-2021-32055: Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync issu...

Security readout for executives and security teams

This affects command-line email clients Mutt and NeoMutt when the optional IMAP QRESYNC feature is enabled. A malformed IMAP sequence set ending in a comma can trigger an out-of-bounds read. The feature is not enabled by default, which limits typical business exposure. Exposure is most likely on endpoints or servers where affected Mutt or NeoMutt versions are installed and IMAP QRESYNC is explicitly enabled. Default configurations are less exposed because $imap_qresync is not enabled by default. Treat this as targeted maintenance unless your organization uses Mutt or NeoMutt with IMAP QRESYNC enabled. Prioritize routine patching and configuration review over emergency response, based on the absence of KEV evidence and default-off exposure. Mitigation focus: Upgrade Mutt to 2.0.7 or later where applicable.; Upgrade NeoMutt to a vendor-fixed version after the affected date range.; Keep $imap_qresync disabled unless a fixed version is deployed..

Prepared

Jun 3, 2026, 02:27 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.