CVE-2003-0299: The IMAP Client, as used in mutt 1.4.1 and Balsa 2.0.10, allows remote malicious IMAP servers to cause a denia

This month

HIGH 7.5DOWNGRADEDOWNGRADE

CVE-2003-0299 is a high-severity flaw (CVSS 7.5) affecting mutt, balsa. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The IMAP Client, as used in mutt 1.4.1 and Balsa 2.0.10, allows remote malicious IMAP servers to cause a denial of service and possibly execute arbitrary code via certain large mailbox size values that cause either integer signedness errors or integer overflow errors.

Why this priority

High severity

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	7.5 (High)
EPSS exploit chance	2.1% (top 18%)
CISA exploited list	No
Published	2003-06-16
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: mutt · stuart parmenter

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2003-06-16 04:00 UTCPublished CVE record published
2026-06-16 22:01 UTCUpdated Record last modified

mutt mutt DOWNGRADE

Affected: 1.4.1

Fixed in: no fixed release known

Safe to downgrade to: a release before 1.4.1

1. Check installed version

apt-cache policy mutt || rpm -q mutt || mutt --version

2. No fixed release: DOWNGRADE to a release before 1.4.1 (Debian / Ubuntu)

apt-cache madison mutt sudo apt install mutt=<VERSION_BEFORE_1.4.1> sudo apt-mark hold mutt

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list mutt sudo dnf downgrade mutt-<VERSION_BEFORE_1.4.1> sudo dnf versionlock add mutt

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

stuart parmenter balsa DOWNGRADE

Affected: 2.0.10

Fixed in: no fixed release known

Safe to downgrade to: a release before 2.0.10

1. Check installed version

apt-cache policy balsa || rpm -q balsa || balsa --version

2. No fixed release: DOWNGRADE to a release before 2.0.10 (Debian / Ubuntu)

apt-cache madison balsa sudo apt install balsa=<VERSION_BEFORE_2.0.10> sudo apt-mark hold balsa

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list balsa sudo dnf downgrade balsa-<VERSION_BEFORE_2.0.10> sudo dnf versionlock add balsa

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2003-0299?

mutt: downgrade or apply the listed mitigation; balsa: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2003-0299 being exploited?

CVE-2003-0299 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2003-0299 affect?

CVE-2003-0299 affects mutt, balsa. Severity is high (CVSS 7.5). The IMAP Client, as used in mutt 1.4.1 and Balsa 2.0.10, allows remote malicious IMAP servers to cause a denial of service and possibly execute arbitrary code via certain large mailbox size values that cause either integer signedness errors

How urgent is CVE-2003-0299?

Priority 47/100. High severity

Related CVEs

CVE-2024-49395 MEDIUM 5.3 MITIGATE MITIGATE In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email head
CVE-2024-49394 MEDIUM 5.3 MITIGATE MITIGATE In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows
CVE-2024-49393 MEDIUM 6.5 MITIGATE MITIGATE In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an at
CVE-2023-4875 LOW 2.2 UPGRADE MITIGATE Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12
CVE-2023-4874 MEDIUM 4.3 UPGRADE MITIGATE Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12

References

← Back to latest CVEs