CVE-2026-103678

MEDIUM 5.4

Tnef: heap out-of-bounds read in get_rtf_data_from_buf() via uncompressed rtf mapi value

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format (RTF) data. Because the application fails to properly validate input buffer boundaries before copying data in get_rtf_data_from_buf(), reading beyond the allocated memory occurs. This flaw can cause the application to crash, leading to a Denial of Service (DoS), or leak sensitive memory contents into extracted output files.

CWE	CWE-125
Published	Oct 1, 2026
Last Updated	Oct 1, 2026

Stay Ahead of the Next One

Get instant alerts for

Be the first to know when new medium vulnerabilities are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

References

NVD ↗ CVE.org ↗ EPSS Data ↗

access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-103678 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2544476 github.com: https://github.com/verdammelt/tnef

Credits

Red Hat would like to thank Julien Ahrens (RCE Security GmbH) for reporting this issue.