VDB
CVE-2019-10732
CVE-2019-10732
PUBLISHED
Reported by mitre · Published April 7, 2019
In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| n/a | n/a | * |
Timeline
- Apr 7, 2019 CVE Published
- Apr 14, 2021 EPSS Score (30 in total, the first dated here)
- Sep 8, 2025 CVE Updated
- Mar 6, 2026 Distribution Patch (2 in total, the first dated here)
- Mar 6, 2026 Security Advisory (5 in total, the first dated here)
- Sep 17, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2019-10732
vulnetix vdb fixes CVE-2019-10732Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2019-10732/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- x_refsource_MISC
- [debian-lts-announce] 20190618 [SECURITY] [DLA 1825-1] kdepim security update mailing-listx_refsource_MLIST