Is CVE-2021-31855 actively exploited?

No active exploitation of CVE-2021-31855 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2021-31855 be exploited remotely?

Yes. CVE-2021-31855 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2021-31855?

CVE-2021-31855 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2021-31855

MEDIUM

CVE-2021-31855

CWE-312Published: June 2, 2021· Updated: Jun 17, 2026

6.5

CVSS v3.1

Official Description

KDE Messagelib through 5.17.0 reveals cleartext of encrypted messages in some situations. Deleting an attachment of a decrypted encrypted message stored on a remote server (e.g., an IMAP server) causes KMail to upload the decrypted content of the message to the remote server. With a crafted message, a user could be tricked into decrypting an encrypted message and then deleting an attachment attached to this message. If the attacker has access to the messages stored on the email server, then the attacker could read the decrypted content of the encrypted message. This occurs in ViewerPrivate::deleteAttachment in messageviewer/src/viewer/viewer_p.cpp.

NVD Source

Technical Analysis

CVE-2021-31855 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 6.5.