The flaw causes Mutt to truncate the hash_passwd by one byte when using IMAP auth_cram with MD5, resulting in an incorrect digest. This undermines authentication integrity, potentially allowing an attacker to bypass password checks or cause authentication failures, thereby affecting availability. The weakness arises from improper string handling (CWE-193).

Mutt versions before 2.3.2 are impacted when configured to use IMAP auth_cram‑MD5. The earliest release that includes the fix is 2.3.2; all earlier builds may be vulnerable.

The CVSS score of 3.7 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves remote interaction with an IMAP server, where the client sends a CRAM‑MD5 challenge and receives a truncated hash. An adversary with network access could exploit this to compromise authentication or cause denial of service by forcing repeated authentication failures. Target systems are client machines running Mutt versions prior to 2.3.2 that employ IMAP auth_cram‑MD5.