CVE-2026-43859
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NSummary
CVE-2026-43859 is a low-severity Improper Neutralization of Null Byte or NUL Character (CWE-158) vulnerability. Its CVSS base score is 3.7 (Low).
Operationally, ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26895
Vulnerability Data
mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Insufficient information to map techniques.CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely patching of the identified strfcpy vs. memcpy flaw in mutt < 2.3.2 before exploitation of CWE-158 occurs.
Mandates developer security testing that would detect incorrect binary digest handling (strfcpy on MD5 output containing NULs) during IMAP CRAM-MD5 implementation.
Requires secure development standards and tools that prohibit unsafe string functions when copying fixed-length binary data such as authentication digests.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization and validation to prevent null-byte flaws.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect null-byte flaws but does not itself implement the neutralization.
Secure development lifecycle mandates input validation and sanitization that directly prevents null-byte injection.
Application security requirements include explicit rules for neutralizing dangerous characters such as NUL.
Secure architecture principles reduce the likelihood of unsafe data flows but do not prescribe character neutralization.
Secure coding standards explicitly require proper neutralization of null bytes and other metacharacters.