The flaw allows an attacker to embed arbitrary email headers into a message when a user triggers the Bounce (resend) action. The vulnerability originates from an improper sanitization of the From display name, which can contain CRLF sequences inside an encoded word. When decoded, these control characters are not removed, allowing injected headers to become part of the resent message. This could lead to spoofing, phishing, or other abuse of mail headers.

Roundcube Webmail is susceptible to this issue in all releases before 1.6.20 and before 1.7.5. Consumers running Roundcube 1.6.x older than 1.6.20 or any 1.7.x version older than 1.7.5 are affected by the header injection flaw.

The vulnerability carries a CVSS score of 5.8, indicating moderate severity, and has no EPSS data available. It is not listed in the CISA KEV catalog. Exploitation requires that an attacker sends a crafted message to a victim and that the victim later uses the Bounce feature. Once a user re-bounces such a message, the attacker’s malicious headers are injected, which may compromise downstream mail systems or facilitate social engineering attacks.