Slackware Mutt Significant Buffer Overflow Patch 2026-186-01

Here are the details from the Slackware 15.0 ChangeLog: patches/packages/mutt-2.4.1-i586-1_slack15.0.txz: Upgraded. This update fixes a security issue: Prevent unsigned int overflow in imap_cmd_step buffer growth. The idata->blen field is unsigned int (32-bit) while the companion variable len is size_t (64-bit on LP64). When a malicious IMAP server sends a response line longer than UINT_MAX bytes without newline, the expression wraps to a small value, causing safe_realloc() to shrink the buffer while len retains its original huge value. The subsequent mutt_socket_readln() then writes far past the shrunken allocation. Fix by changing idata->blen from unsigned int to size_t, matching the type of len and preventing the overflow on all platforms. (* Security fix *)