Vulnerability · Published Oct 1, 2026 · Assigned by fedora

CVE-2026-103678Tnef: heap out-of-bounds read in get_rtf_data_from_buf() via uncompressed rtf mapi value

Medium 5.4

In plain English

A medium-severity out-of-bounds read in tnef. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 85.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format (RTF) data. Because the application fails to properly validate input buffer boundaries before copying data in get_rtf_data_from_buf(), reading beyond the allocated memory occurs. This flaw can cause the application to crash, leading to a Denial of Service (DoS), or leak sensitive memory contents into extracted output files.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	tnef	no fix listed	DEBIAN-CVE-2026-103678
Debian:13	tnef	no fix listed	DEBIAN-CVE-2026-103678
Debian:14	tnef	no fix listed	DEBIAN-CVE-2026-103678
Ubuntu:22.04:LTS	tnef	no fix listed	UBUNTU-CVE-2026-103678
Ubuntu:24.04:LTS	tnef	no fix listed	UBUNTU-CVE-2026-103678
Ubuntu:26.04:LTS	tnef	no fix listed	UBUNTU-CVE-2026-103678
Ubuntu:26.10	tnef	no fix listed	UBUNTU-CVE-2026-103678

Affected products (as reported)

Vendor	Product	Versions
	tnef	0 – through 1.4.18

Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

References

https://access.redhat.com/security/cve/CVE-2026-103678 vdb-entry, x_refsource_REDHAT
RHBZ#2544476 issue-tracking, x_refsource_REDHAT
https://github.com/verdammelt/tnef