Symfony’s Address object validates email addresses but incorrectly allows RFC‑5322 quoted strings that contain literal CRLF bytes in the local‑part, such as "x\r\nBcc: attacker@evil"@example.com. When used, the embedded CRLF is turned into a new email header or SMTP command during message rendering or transmission. This lets an attacker inject arbitrary headers or SMTP commands into outgoing mail, potentially forging sender, recipient, or abusing the system for phishing or mass‑mailing.

Any Symfony application using the Mailer component before the fix is impacted. Versions prior to the patched releases—5.4.52, 6.4.40, 7.4.12, and 8.0.12—are vulnerable, covering Symfony through 5.4.51, 6.4.x through 7.4.11, and 8.0.x before 8.0.12.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score < 1% suggests a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV database. An attacker would need to provide user input that creates an Address object; the exploit is limited to forging email content and not to system compromise.