# CVE-2023-4875: mutt: Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12

CVE-2023-4875 is fixed in 3 products on 1 platform, first by mutt 1.9.4-3ubuntu0.6+esm1, released September 9, 2023. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2023-4875
- Priority: Routine
- CVSS: 5.7 (medium)
- EPSS: 0.0055
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 9, 2023

## Description

Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | mutt Debian 12.15 (bookworm) | 2.2.9-1+deb12u1 | [DEBIAN-CVE-2023-4875](https://patchblox.com/security/data/fix/linux/debian-cve-2023-4875.md) | Sep 9, 2023 |
| Linux | mutt Debian 13.5 (trixie) | 2.2.12-0.1 | [DEBIAN-CVE-2023-4875](https://patchblox.com/security/data/fix/linux/debian-cve-2023-4875.md) | Sep 9, 2023 |
| Linux | mutt Debian 14 | 2.2.12-0.1 | [DEBIAN-CVE-2023-4875](https://patchblox.com/security/data/fix/linux/debian-cve-2023-4875.md) | Sep 9, 2023 |
| Linux | mutt RHEL 8 | 5:2.0.7-3.el8 | [RHSA-2024:3058](https://patchblox.com/security/data/fix/linux/rhsa-2024-3058.md) | May 22, 2024 |
| Linux | mutt RHEL 9 | 5:2.2.6-2.el9 | [RHSA-2024:2290](https://patchblox.com/security/data/fix/linux/rhsa-2024-2290.md) | Apr 30, 2024 |
| Linux | mutt Ubuntu 18.04.6 LTS (bionic) | 1.9.4-3ubuntu0.6+esm1 | [mutt 1.9.4-3ubuntu0.6+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-mutt-1.9.4-3ubuntu0.6-esm1.md) | Sep 9, 2023 |
| Linux | mutt Ubuntu 20.04 LTS (focal) | 1.13.2-1ubuntu0.6 | [mutt 1.13.2-1ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-focal-mutt-1.13.2-1ubuntu0.6.md) | Sep 9, 2023 |
| Linux | mutt Ubuntu 22.04.1 LTS (jammy) | 2.1.4-1ubuntu1.2 | [mutt 2.1.4-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-mutt-2.1.4-1ubuntu1.2.md) | Sep 9, 2023 |
| Linux | mutt almalinux 8 | 5:2.0.7-3.el8 | [ALSA-2024:3058](https://patchblox.com/security/data/fix/linux/alsa-2024-3058.md) | May 22, 2024 |
| Linux | mutt almalinux 9 | 5:2.2.6-2.el9 | [ALSA-2024:2290](https://patchblox.com/security/data/fix/linux/alsa-2024-2290.md) | Apr 30, 2024 |
| Linux | mutt amzn 2023 | 5:2.2.9-1.amzn2023.0.2 | [ALAS2023-2023-357](https://patchblox.com/security/data/fix/linux/alas2023-2023-357.md) | Sep 27, 2023 |
| Linux | mutt ol 8 | 5:2.0.7-3.el8 | [ELSA-2024-3058](https://patchblox.com/security/data/fix/linux/elsa-2024-3058.md) | May 23, 2024 |
| Linux | mutt ol 9 | 5:2.2.6-2.el9 | [ELSA-2024-2290](https://patchblox.com/security/data/fix/linux/elsa-2024-2290.md) | May 2, 2024 |
| Linux | mutt rocky 8 | 5:2.0.7-3.el8 | [RLSA-2024:3058](https://patchblox.com/security/data/fix/linux/rlsa-2024-3058.md) | Jun 14, 2024 |
| Linux | mutt rocky 9 | 5:2.2.6-2.el9 | [RLSA-2024:2290](https://patchblox.com/security/data/fix/linux/rlsa-2024-2290.md) | May 7, 2025 |
| Linux | mutt-debuginfo amzn 2023 | 5:2.2.9-1.amzn2023.0.2 | [ALAS2023-2023-357](https://patchblox.com/security/data/fix/linux/alas2023-2023-357.md) | Sep 27, 2023 |
| Linux | mutt-debugsource amzn 2023 | 5:2.2.9-1.amzn2023.0.2 | [ALAS2023-2023-357](https://patchblox.com/security/data/fix/linux/alas2023-2023-357.md) | Sep 27, 2023 |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo