mutt before 2.3.2 does not perform a null terminator check in the url_pct_decode function, which can cause the program to read beyond intended buffer boundaries when encountering a URL with an embedded null character. The resulting undefined behavior may lead to a program crash, effectively denying the service to legitimate users. This weakness is categorized as CWE-158.

The vulnerability affects the mutt mail user agent for all releases prior to version 2.3.2. No other vendors or product variants are mentioned in the available data.

The CVSS score of 3.7 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploit activity is either not widespread or not officially documented. The likely attack vector is local or remote via email content that contains a malicious URL; an attacker could craft a message that triggers the buggy decoding path, leading to a crash. Exploitation requires the vulnerable version of mutt to process the crafted URL, which is feasible in environments where mutt is the default mail client or is invoked by a mail handling script.