CVE-2026-13324
Description
A vulnerability has been identified in the GNOME Geary package within its mailto URI handling component. This flaw occurs because the email client automatically processes a non-standard attach parameter in email links without prompting or alerting the user.
An attacker could exploit this by tricking a user into clicking a specially crafted link (for example, mailto:user@example.com?attach=/path/to/sensitive_file). When clicked, Geary will automatically open a new compose window with the specified local file already attached. Because there is no dialog box or visual warning indicating that the file was attached by the link rather than the user, the user might unknowingly send sensitive files or data to the attacker upon hitting send.
Statement
This issue is classified as Moderate severity primarily.
Conditions for Exploitation: Exploitation requires significant user interaction, as a victim must be tricked into manually sending the email without noticing the unexpectedly attached file.
Impact Limitations: The vulnerability is strictly limited to targeted information disclosure, and does not allow for remote code execution, broader system compromise, or privilege escalation.
Mitigation
To mitigate this risk, avoid clicking untrusted `mailto` links and always review all attachments before sending an email.
Alternatively, you can configure a different email client as your default `mailto` handler to disable Geary's automatic attachment functionality.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
