Mutt before version 2.3.2 sometimes copies the IMAP CRAM‑MD5 authentication digest using the strfcpy function instead of memcpy. This incorrect copy operation can lead to a buffer overrun or truncation of the digest, corrupting memory and potentially causing a crash or denial of service to the mail client. The vulnerability does not provide a clear path to arbitrary code execution but could be leveraged to destabilize the application during an IMAP authentication session.

The affected product is the open‑source mail user agent Mutt from the mutt project. All releases prior to 2.3.2 are vulnerable, while version 2.3.2 and later include the fix that replaces strfcpy with the correct memcpy usage.

The CVSS score of 3.7 indicates moderate severity, and the EPSS score is not available, so the actual exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog, suggesting it is not a widely recognized or actively exploited issue. Based on the description, the likely attack vector is remote or local via IMAP authentication, requiring an attacker to trigger the CRAM‑MD5 digest path to induce memory corruption. The impact is primarily application instability rather than privilege escalation or data exfiltration.