The vulnerability manifests as an infinite loop triggered during GPG data handling in mutt before 2.3.2. When the loop engages, the mail client consumes CPU cycles indefinitely, rendering it unresponsive and blocking further email operations. This creates a denial‑of‑service condition that can affect a single user or an entire host running the software, depending on the deployment environment.

Installations of the mutt email client with any version earlier than 2.3.2 are impacted. The flaw is confined to the crypt-gpgme.c component, which processes gpgme data objects. Only the mutt product is affected; no other vendor or product is listed.

The CVSS score of 3.7 indicates medium severity. EPSS is not available, and the vulnerability is not included in the CISA KEV catalog, implying no known widespread exploitation. The attack likely requires an attacker to provide a specially crafted email or data object that invokes data_object_to_stream, pointing to a local or remote vector via email processing. Since the flaw is an input handling error, exploitation depends on supplying the triggering content; otherwise the client remains unaffected.