Medium 5.9Published May 16, 2018

CVE-2017-17688The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.

Updated under an hour ago (Nov 2, 2026, 3:00 AM ET)

Does this affect you?

It affects apple mail and 10 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stackFree account, 3 products Every CVE for apple mail Exploited in the last 30 days

The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification

CVSS: 5.9 MEDIUM (v3.0, NVD)CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Modified
Record last updated: Jun 16, 2026
First seen by InfoSec Signals: Nov 1, 2026

Affected products

Affected products

apple mail apple:mail	all versions; all versions	NVD
bloop airmail bloop:airmail	all versions	NVD
emclient emclient emclient:emclient	all versions	NVD
flipdogsolutions maildroid flipdogsolutions:maildroid	all versions	NVD
freron mailmate freron:mailmate	all versions	NVD
horde horde_imp horde:horde_imp	all versions	NVD
microsoft outlook microsoft:outlook	2007	NVD
mozilla thunderbird mozilla:thunderbird	all versions	NVD
postbox-inc postbox postbox-inc:postbox	all versions	NVD
r2mail2 r2mail2 r2mail2:r2mail2	all versions	NVD
1–10 of 11

References

References

http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.html	third-party-advisory
http://www.securityfocus.com/bid/104162	third-party-advisory, vdb-entry
http://www.securitytracker.com/id/1040904	third-party-advisory, vdb-entry
https://efail.de	exploit, mitigation, third-party-advisory
https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060334.html	third-party-advisory
https://news.ycombinator.com/item?id=17066419	issue-tracking, third-party-advisory
https://protonmail.com/blog/pgp-vulnerability-efail	issue-tracking, third-party-advisory
https://twitter.com/matthew_d_green/status/995996706457243648	third-party-advisory
https://www.patreon.com/posts/cybersecurity-15-18814817	issue-tracking, third-party-advisory
https://www.synology.com/support/security/Synology_SA_18_22	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.