CVE-2026-103680
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A heap-based buffer overflow exists in the tnef library's find_free_number() function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted TNEF file with an excessive number of colliding attachment filenames, causing the numeric counter to write past the allocated memory buffer.
Risk Assessment
This may result in an application crash, leading to a Denial of Service (DoS), or potentially arbitrary code execution.
Recommendation
Update the tnef library to a version containing the fix, or avoid processing untrusted TNEF files until the update is applied.
Other vulnerabilities in tnef
See all- CVE-2017-6310High
An issue was discovered in tnef before 1.4.13 related to four type confusions in the file_add_mapi_attrs() function. This may lead to invalid read and write operations controlled by an attacker.
- CVE-2017-6309High
An issue was discovered in tnef before version 1.4.13 related to two type confusions in the parse_file() function. This may lead to invalid read and write operations controlled by an attacker.
- CVE-2017-6308High
An issue was discovered in tnef before version 1.4.13 related to integer overflows that can lead to heap overflows in functions handling memory allocation.
- CVE-2017-6307High
An issue was discovered in tnef before version 1.4.13 related to two OOB Write operations in the mapi_attr_read() function. These may lead to invalid read and write operations controlled by an attacker.
- CVE-2017-8911Critical
An integer underflow has been identified in the unicode_to_utf8() function in tnef 1.4.14. This might lead to invalid write operations, controlled by an attacker.
- CVE-2026-103679Medium
A flaw was found in the tnef library involving improper memory management when processing specially crafted TNEF files with multiple message bodies. This leads to use-after-free and double-free conditions, causing the application to crash and resulting in a Denial of Service (DoS).
- CVE-2026-103678Medium
A flaw was found in the tnef library due to improper validation of input buffer boundaries before copying data in get_rtf_data_from_buf(). A specially crafted file with uncompressed RTF data can cause reading beyond allocated memory, leading to a crash (DoS) or leaking sensitive memory contents into extracted output files.
Original NVD description (English source)
A flaw was found in tnef. A heap-based buffer overflow can occur in the find_free_number() function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral Encapsulation Format (TNEF) file with an excessive number of colliding attachment filenames, causing the numeric counter to write past the allocated memory buffer. This issue may result in an application crash, leading to a Denial of Service (DoS), or potentially arbitrary code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS