The Mail gem is a Ruby library for creating and parsing email messages. A flaw existed in the decoding routine for RFC 2047 encoded‑words that only processed the first encoded‑word and did not properly isolate surrounding text. As a result, a crafted malformed encoded‑word in an address display name or local part could be decoded in a way that made the From, To, or Reply‑To header values appear different from the raw header values reviewed by humans or consumed by downstream parsers. This mismatch enables attackers to spoof sender or recipient addresses, facilitate phishing campaigns, or bypass authorization checks that rely on parsed address fields.

The vulnerability affects the mikel:mail library (Mail gem) in all releases before version 2.9.1. Applications that embed or require the gem in a Ruby environment and process incoming or outgoing email headers are susceptible as long as they use an unpatched version.

The CVSS score of 5.3 indicates moderate severity, but the lack of an EPSS score and absence from CISA KEV suggests the exploitation likelihood is not well quantified. The most plausible attack vector is a remote attacker sending a maliciously crafted email that an application using the vulnerable gem parses. If the application trusts the decoded header for authentication or display, the spoofed address can deceive users or undermine authorization logic. The impact is limited to environments where address verification is performed on the parsed values rather than the raw headers, and no immediate requirement for system privileges is disclosed.