CVE-2026-116266 Affecting libmime-tools-perl package, versions <5.522-1

Note: Versions mentioned in the description apply only to the upstream libmime-tools-perl package and not the libmime-tools-perl package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguous.

The multipart_boundary() method decodes RFC 2047 encoded words anywhere in the boundary, but the ambiguity check only fires when the whole value is one encoded word. A boundary such as abc=?us-ascii?Q?def?= is used as abcdef, and ambiguous_content() returns false.

Encoded words are not allowed in parameters, so other mail readers split the message on the literal value. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.

• https://security-tracker.debian.org/tracker/CVE-2026-116266
• https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes