Description
In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | kf5-messagelib | 4:19.08.3-1 | — |
| Debian 8 | kdepim | 4:4.14.1-1+deb8u2 | DLA-1825-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | kf5-messagelib | 4:17.12.3-0ubuntu3+esm1 | USN-7730-1 |
| Ubuntu Pro 16.04 LTS | kdepim | 4:15.12.3-0ubuntu1.1+esm1 | USN-7729-1 |
| Ubuntu Pro 14.04 LTS | kdepim | 4:4.13.3-0ubuntu0.2+esm1 | USN-7729-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP1 | messagelib | 18.12.3-bp151.3.3.1 | openSUSE-SU-2021:0227-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | messagelib | 21.08.1-1.2 | openSUSE-SU-2024:11046-1 |
| openSUSE Leap 15.1 | messagelib | 18.12.3-lp151.2.4.1 | openSUSE-SU-2021:0188-1 |
Advisories 7
- USN-7729-1 kdepim vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-7730-1 kf5-messagelib vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-1825-1 kdepim - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11046-1 messagelib-21.08.1-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:0188-1 Security update for messagelib SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:0227-1 Security update for messagelib SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-1950 Kmail: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Sep 2, 2025