The vulnerability arises from a cross‑site scripting flaw in the Icewarp Client that permits attackers to embed base64‑encoded payloads inside object and embed tags of an email. When a recipient opens the compromised message, the payload is executed by the client, enabling arbitrary script execution in the user’s browser context. The comic effect can compromise the viewing user’s session and expose sensitive data, as the injected script runs with the same privileges as the user. This flaw is listed as CWE‑79, a classic reflected XSS weakness.

Icewarp Client is affected in the 10.3.4 and 11.0.0.0 releases. Both versions allow the described HTML injection when an email is rendered, so any user running those client versions that receives a malicious message is at risk. The issue is confined to the client software and does not affect the Icewarp mail server component directly.

The CVSS score of 5.1 indicates a medium severity assessment. EPSS data is not available, so the likelihood of widespread exploitation remains undetermined from public metrics. The flaw is not listed in the CISA KEV catalog, suggesting no documented active exploitation at the time of the advisory. Attackers would need to deliver a crafted email containing the malicious payload, so the vulnerability is primarily remote and relies on user interaction. The absence of server‑side checks means a malicious sender can freely propagate the exploit via spam or phishing campaigns.