CVE-2026-62642
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment.
| CWE | CWE-835 |
| Vendor | roundcube |
| Product | webmail |
| Published | Jul 14, 2026 |
| Last Updated | Jul 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for roundcube webmail
Be the first to know when new medium vulnerabilities affecting roundcube webmail are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Affected Versions
Roundcube / Webmail
1.6.0 < 1.6.17 1.7.0 < 1.7.2
References
roundcube.net: https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2 github.com: https://github.com/roundcube/roundcubemail/releases/tag/1.7.2 github.com: https://github.com/roundcube/roundcubemail/commit/877269c79359d959a94f13c9070cab0f3389c193 github.com: https://github.com/roundcube/roundcubemail/commit/fb952956c6eaf29e963f1a718d028d66e7957ce0 github.com: https://github.com/roundcube/roundcubemail/releases/tag/1.6.17 github.com: https://github.com/roundcube/roundcubemail/commit/a007321346380136b3de2bd75b486b04f63c0d38 github.com: https://github.com/roundcube/roundcubemail/commit/132ac8dd5a55c8466be12de1daf84355697ffa89