CVE-2026-13324

[CVE catalog]

A vulnerability has been identified in the **GNOME Geary** package within its **`mailto` URI handling** component. This flaw occurs because the email client automatically processes a non-standard `attach` parameter in email links without prompting or alerting the user. An attacker could exploit this by tricking a user into clicking a specially crafted link (for example, `mailto:user@example.com?attach=/path/to/sensitive_file`). When clicked, Geary will automatically open a new compose window with the specified local file already attached. Because there is no dialog box or visual warning indicating that the file was attached by the link rather than the user, the user might unknowingly send sensitive files or data to the attacker upon hitting send. - This issue is classified as Moderate severity primarily. - Conditions for Exploitation: Exploitation requires significant user interaction, as a victim must be tricked into manually sending the email without noticing the unexpectedly attached file. - Impact Limitations: The vulnerability is strictly limited to targeted information disclosure, and does not allow for remote code execution, broader system compromise, or privilege escalation. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Published

Jun 25, 2026, 10:07:00 AM UTC

Source

[NVD] · [CVE record]

{
  "package_releases": [
    {
      "name": "geary",
      "status": "vulnerable",
      "release": "sid",
      "version": "46.0-16"
    },
    {
      "name": "geary",
      "status": "vulnerable",
      "release": "forky",
      "version": "46.0-16"
    },
    {
      "name": "geary",
      "status": "vulnerable",
      "release": "trixie",
      "version": "46.0-7"
    },
    {
      "name": "geary",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "43.0-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1143073,
      "name": "geary",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1143073,
      "name": "geary",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1143073,
      "name": "geary",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1143073,
      "name": "geary",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": []
}