MimeKit contains a flaw that enables an attacker to inject CRLF sequences into a quoted local‑part of an email address during serialization to an SMTP session. The injection allows arbitrary SMTP commands, such as RCPT TO, DATA, or RSET, to be added, leading to mail header tampering or the forging of email messages. The issue violates RFC 5321 and is categorized as a CRLF injection (CWE‑93), potentially compromising the integrity and authenticity of outgoing mail.

The vulnerable component is MimeKit, a C# library maintained by jstedfast. All releases prior to 4.15.1 are susceptible. Applications that use MimeKit to build or parse email messages and then send them via SMTP are affected if they construct a MailboxAddress with a quoted local‑part that is not properly sanitized.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of 1% reflects a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to influence a MailboxAddress that is later serialized to an SMTP session, which is most likely in scenarios where user or untrusted data is used to form email addresses. Although a public exploit is not currently available, the potential for serious email tampering warrants timely remediation.