CVE-2026-111145
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in DecompressRTF() in lib/ytnef.c that never validates uncompressedSize for uncompressed RTF streams. Attackers can supply a crafted winmail.dat TNEF attachment with a malicious PT_BINARY MAPI property.
Risk Assessment
This can crash ytnefprint or libytnef callers and leak adjacent heap memory.
Recommendation
Update ytnef to a version containing the fix or avoid processing untrusted winmail.dat attachments.
Other vulnerabilities in ytnef
See all- CVE-2017-6802High
An issue was discovered in ytnef before 1.9.2 related to a potential heap-based buffer over-read on incoming Compressed RTF Streams, concerning the DecompressRTF() function in libytnef.
- CVE-2017-6801High
An issue was discovered in ytnef before version 1.9.2, which may lead to out-of-bounds access due to fields of Size 0 in TNEFParse() in libytnef.
- CVE-2017-6800High
An issue was discovered in ytnef before 1.9.2. An invalid memory access (heap-based buffer over-read) can occur during handling of LONG data types, related to MAPIPrint() in libytnef.
- CVE-2017-6306High
An issue was discovered in ytnef before version 1.9.1 related to directory traversal using the filename, associated with the SanitizeFilename function in settings.c.
- CVE-2017-6305High
An issue was discovered in ytnef before version 1.9.1 related to a patch described as '8 of 9. Out of Bounds read and write.'
- CVE-2017-6304High
An issue was discovered in ytnef before version 1.9.1 related to a patch described as '7 of 9. Out of Bounds read.'
- CVE-2017-6303High
An issue was discovered in ytnef before version 1.9.1 related to invalid write and integer overflow, which may lead to unauthorized access or data corruption.
- CVE-2017-6302High
An issue was discovered in ytnef before version 1.9.1 related to an integer overflow, described as '5 of 9'.
- CVE-2017-6301High
An issue was discovered in ytnef before version 1.9.1 related to out of bounds reads.
- CVE-2017-6300High
An issue was discovered in ytnef before 1.9.1 related to a buffer overflow in the version field in lib/tnef-types.h.
Original NVD description (English source)
ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in DecompressRTF() in lib/ytnef.c that never validates uncompressedSize for uncompressed RTF streams. Attackers can supply a crafted winmail.dat TNEF attachment with a malicious PT_BINARY MAPI property to crash ytnefprint or libytnef callers and leak adjacent heap memory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS