The vulnerability is a NULL pointer dereference in the show_sig_summary function of mutt, which may cause the application to crash when attempting to display a message signature summary. The resulting denial‑of‑service occurs by a local user sending or interacting with a message that triggers the faulty code. The weakness is a classic null dereference (CWE‑476).

Mutt, versions prior to 2.3.2 are affected. All users running the email client on desktop, server, or embedded environments with these versions are potentially impacted.

The CVSS score is 2.5, indicating low overall severity. No EPSS score is available and the vulnerability is not listed in CISA KEV, suggesting a modest likelihood of exploitation. The attack likely requires local access or the ability to influence the content of a message viewed by the user. Given the low severity and limited exploitation evidence, the risk is considered low but sufficient to warrant remediation.