The vulnerability manifests as an infinite loop triggered during GPG data handling in mutt before 2.3.2. The flaw involves incorrect input validation (CWE-253), which creates the infinite loop (CWE-835). When the loop engages, the mail client consumes CPU cycles indefinitely, rendering it unresponsive and blocking further email operations. This creates a denial‑of‑service condition that can affect a single user or an entire host running the software, depending on the deployment environment.

Installations of the mutt email client with any version earlier than 2.3.2 are impacted. The flaw is confined to the crypt-gpgme.c component, which processes gpgme data objects. Only the mutt product is affected; no other vendor or product is listed.

The CVSS score of 3.7 indicates medium severity. The EPSS score is < 1% (0.00033), indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation. The attack likely requires an attacker to provide a specially crafted email or data object that invokes data_object_to_stream, pointing to a local or remote vector via email processing. Since the flaw is an input handling error, exploitation depends on supplying the triggering content; otherwise the client remains unaffected.