> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# MIME and S/MIME (MI)

- URL: /taxonomies/email-infrastructure/mime-and-s-mime/
- Published: 2026-10-31T13:00:00.000Z
- Updated: 2026-11-02T17:53:02.112Z
- Description: MIME and S/MIME (MI): 13 threats in the email infrastructure threat taxonomy, with mitigations. How content is parsed, decoded, rendered, signed and encrypted.
- Author: Brett Crawley

[Taxonomies](/taxonomies/) › [Email infrastructure](/taxonomies/email-infrastructure/) › MIME and S/MIME

**Layer 05 of 09 · 13 threats · prefix MI**

Every component that handles a message should interpret it the same way, and most content attacks live where they do not. These entries cover how content is parsed, decoded, rendered, signed and encrypted.

**Scope:** How content is parsed, decoded, rendered, signed and encrypted.

![Table: MIME and S/MIME (MI), 13 threats with their mitigation principles and design measures. The full text is in the PDF and Excel downloads on the email infrastructure taxonomy overview page.](https://www.ostering.com/media/posts/98/email-taxonomy-table-05-MI.png =1400x4148)

*Text version: every entry on this page is in the [PDF and Excel downloads](/taxonomies/email-infrastructure/) on the overview page, where it can be searched and copied.*

## The threats

- <span id="em-mi-a"></span><span id="mi-a"></span>**EM-MI-A** Structure Differential
- <span id="em-mi-k"></span><span id="mi-k"></span>**EM-MI-K** Encoding Abuse
- <span id="em-mi-q"></span><span id="mi-q"></span>**EM-MI-Q** Content-Type Confusion
- <span id="em-mi-j"></span><span id="mi-j"></span>**EM-MI-J** Active and Remote Content
- <span id="em-mi-10"></span><span id="mi-10"></span>**EM-MI-10** Signature Stripping and Wrapping
- <span id="em-mi-9"></span><span id="mi-9"></span>**EM-MI-9** Encryption as Blindfold and Oracle
- <span id="em-mi-8"></span><span id="mi-8"></span>**EM-MI-8** Header Differential
- <span id="em-mi-7"></span><span id="mi-7"></span>**EM-MI-7** Attachment Identity Deception
- <span id="em-mi-6"></span><span id="mi-6"></span>**EM-MI-6** Nesting and Decompression Exhaustion
- <span id="em-mi-5"></span><span id="mi-5"></span>**EM-MI-5** Embedded Format Blind Spots
- <span id="em-mi-4"></span><span id="mi-4"></span>**EM-MI-4** Display Divergence
- <span id="em-mi-3"></span><span id="mi-3"></span>**EM-MI-3** Parser Memory Safety
- <span id="em-mi-2"></span><span id="mi-2"></span>**EM-MI-2** Certificate and Key Handling

## Where this layer touches others

- **MIME and delivery pipeline:** MIME is how a message is interpreted. The pipeline is whether and when it is inspected.

## STRIDE, CAPEC and CWE

Of the 13 entries here, STRIDE fits 8 cleanly and 5 only loosely. CAPEC 3.9 has a pattern that describes 6 of them directly, only a generic parent pattern for 6, and nothing for 1. CWE 4.20 names the weakness directly for 10, has only a broader weakness for 3,. The table below gives the mapping entry by entry, with the names of the CAPEC patterns and CWE weaknesses; what the mapping shows across the whole taxonomy is in [Mapping the Email Threat Taxonomy to STRIDE, CAPEC and CWE](/email-threat-taxonomy-mapping). The Excel, SKOS and STIX downloads carry the same mapping as text.

![Table: STRIDE, CAPEC and CWE mapping for MIME and S/MIME (MI), 13 threats, with each entry's STRIDE categories and fit, CAPEC 3.9 patterns and CWE 4.20 weaknesses. The full mapping is in the Excel, SKOS and STIX downloads on the email infrastructure taxonomy overview page.](https://www.ostering.com/media/posts/98/email-mapping-table-05-MI.png =1400x2445)

---

← [SMTP (SM)](/taxonomies/email-infrastructure/eoef-smtp/) · [Email infrastructure overview](/taxonomies/email-infrastructure/) · [DNS layer (DN)](/taxonomies/email-infrastructure/eoef-dns-layer/) →

*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [email infrastructure overview](/taxonomies/email-infrastructure/).*