Skip to content
Fencer Vulns
medium 4.3

CVE-2019-10732 json

In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email.

published 2019-04-07 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-2526

cvss
4.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 51%
public exploits
0
none known

Summary

In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.

Patch / fix

  • kf5-messagelib Debian 12 4:19.08.3-1

debian advisories DEBIAN-CVE-2019-10732

  • kdepim Ubuntu Pro 14.04 LTS 4:4.13.3-0ubuntu0.2+esm1
  • kdepim Ubuntu Pro 16.04 LTS 4:15.12.3-0ubuntu1.1+esm1
  • kf5-messagelib Ubuntu Pro 18.04 LTS 4:17.12.3-0ubuntu3+esm1

ubuntu advisories UBUNTU-CVE-2019-10732

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • messagelib openSUSE Tumbleweed 21.08.1-1.2
  • messagelib Package Hub 15 SP1 18.12.3-bp151.3.3.1
  • messagelib openSUSE Leap 15.1 18.12.3-lp151.2.4.1

opensuse advisories openSUSE-SU-2024:11046-1openSUSE-SU-2021:0227-1openSUSE-SU-2021:0188-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-10732 updated cvss 5.7

kmail: decryption based on replying to PGP or S/MIME encrypted emails

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.65% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • bugs.kde.org https://bugs.kde.org/show_bug.cgi?id=404698 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-319 Cleartext Transmission of Sensitive Information

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.