CVE-2026-103678
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A flaw was found in the tnef library due to improper validation of input buffer boundaries before copying data in get_rtf_data_from_buf(). A specially crafted file with uncompressed RTF data can cause reading beyond allocated memory, leading to a crash (DoS) or leaking sensitive memory contents into extracted output files.
Risk Assessment
The attack can crash the application or leak sensitive data from memory into extracted files, posing a confidentiality risk.
Recommendation
Update the tnef library to a patched version. Also avoid processing RTF files from untrusted sources.
Other vulnerabilities in tnef
See all- CVE-2017-6310High
An issue was discovered in tnef before 1.4.13 related to four type confusions in the file_add_mapi_attrs() function. This may lead to invalid read and write operations controlled by an attacker.
- CVE-2017-6309High
An issue was discovered in tnef before version 1.4.13 related to two type confusions in the parse_file() function. This may lead to invalid read and write operations controlled by an attacker.
- CVE-2017-6308High
An issue was discovered in tnef before version 1.4.13 related to integer overflows that can lead to heap overflows in functions handling memory allocation.
- CVE-2017-6307High
An issue was discovered in tnef before version 1.4.13 related to two OOB Write operations in the mapi_attr_read() function. These may lead to invalid read and write operations controlled by an attacker.
- CVE-2017-8911Critical
An integer underflow has been identified in the unicode_to_utf8() function in tnef 1.4.14. This might lead to invalid write operations, controlled by an attacker.
- CVE-2026-103680Low
A heap-based buffer overflow exists in the tnef library's find_free_number() function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted TNEF file with an excessive number of colliding attachment filenames, causing the numeric counter to write past the allocated memory buffer.
- CVE-2026-103679Medium
A flaw was found in the tnef library involving improper memory management when processing specially crafted TNEF files with multiple message bodies. This leads to use-after-free and double-free conditions, causing the application to crash and resulting in a Denial of Service (DoS).
Original NVD description (English source)
A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format (RTF) data. Because the application fails to properly validate input buffer boundaries before copying data in get_rtf_data_from_buf(), reading beyond the allocated memory occurs. This flaw can cause the application to crash, leading to a Denial of Service (DoS), or leak sensitive memory contents into extracted output files.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS