CVE-2026-103679
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A flaw was found in the tnef library involving improper memory management when processing specially crafted TNEF files with multiple message bodies. This leads to use-after-free and double-free conditions, causing the application to crash and resulting in a Denial of Service (DoS).
Risk Assessment
A remote attacker can crash the application, leading to service unavailability. Inability to process TNEF files may disrupt systems relying on this library.
Recommendation
Update the tnef library to a patched version. Also consider restricting acceptance of TNEF files from untrusted sources.
Other vulnerabilities in tnef
See all- CVE-2017-6310High
An issue was discovered in tnef before 1.4.13 related to four type confusions in the file_add_mapi_attrs() function. This may lead to invalid read and write operations controlled by an attacker.
- CVE-2017-6309High
An issue was discovered in tnef before version 1.4.13 related to two type confusions in the parse_file() function. This may lead to invalid read and write operations controlled by an attacker.
- CVE-2017-6308High
An issue was discovered in tnef before version 1.4.13 related to integer overflows that can lead to heap overflows in functions handling memory allocation.
- CVE-2017-6307High
An issue was discovered in tnef before version 1.4.13 related to two OOB Write operations in the mapi_attr_read() function. These may lead to invalid read and write operations controlled by an attacker.
- CVE-2017-8911Critical
An integer underflow has been identified in the unicode_to_utf8() function in tnef 1.4.14. This might lead to invalid write operations, controlled by an attacker.
- CVE-2026-103680Low
A heap-based buffer overflow exists in the tnef library's find_free_number() function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted TNEF file with an excessive number of colliding attachment filenames, causing the numeric counter to write past the allocated memory buffer.
- CVE-2026-103678Medium
A flaw was found in the tnef library due to improper validation of input buffer boundaries before copying data in get_rtf_data_from_buf(). A specially crafted file with uncompressed RTF data can cause reading beyond allocated memory, leading to a crash (DoS) or leaking sensitive memory contents into extracted output files.
Original NVD description (English source)
A flaw was found in tnef. A remote attacker could exploit this vulnerability by providing a specially crafted Transport Neutral Encapsulation Format (TNEF) file containing multiple message bodies. During extraction, improper memory management triggers a use-after-free and double-free condition, causing the application to crash and resulting in a Denial of Service (DoS).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS