C is not too bad in this situation. If you implement DEP + ASLR correctly and do not give the attacker access to an interpreter (javascript/fonts/xslt/etc) then

C is not too bad in this situation. If you implement DEP + ASLR correctly and do not give the attacker access to an interpreter (javascript/fonts/xslt/etc) then it is quite difficult (impossible except for luck?) for an offline attacker to gain code execution. You need to leak information about the programs memory layout in order to bypass DEP but how do you do that with an email? The best vector is probably taking control of the IMAP/POP server Mutt is connecting to and finding a vuln that will leak an address back to the server and another vuln that will take control over the instruction pointer. Or alternatively hope there is some broken shell command injection lurking in Mutt.