Tnef: Out-of-bounds read in uncompressed RTF processing
Summary
The tnef tool, which unpacks Microsoft TNEF attachments (often winmail.dat), reads beyond a buffer in get_rtf_data_from_buf() when it processes uncompressed RTF data. An attacker who supplies a specially crafted TNEF file can crash the application (denial of service) or cause memory contents to be written into extracted output files. Exploitation requires that a user or a processing pipeline opens or extracts the file. Severity scores differ between sources: 8.1 in the NVD data provided, 5.4 in Ubuntu and OpenCVE.
Affected
- tnef up to and including 1.4.18 (CNA record: 0 to <= 1.4.18)
- Debian and Ubuntu list tnef as vulnerable; no distribution fix found
Fixed in
Unknown.
Workaround
- Do not extract untrusted winmail.dat attachments with tnef, or run it in an isolated, low-privilege sandbox
- Disable automatic extraction of TNEF attachments in mail gateways or helper scripts
- Restrict the output directory for extracted files
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact partial
- EPSS about 0.002
- No public proof of concept or KEV listing found
Our recommendation
- Check whether tnef is installed and used on mail gateways, mail-processing scripts or workstations
- Apply the vendor patch once your distribution provides one; monitor the upstream repository and Bugzilla
- Verify the final NVD CVSS score before setting priority
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE page CVE-2026-103678 access.redhat.com
- Red Hat Bugzilla 2544476 bugzilla.redhat.com
- Ubuntu security CVE-2026-103678 ubuntu.com
- Debian security tracker tnef security-tracker.debian.org
- OpenCVE CVE-2026-103678 app.opencve.io
- tnef upstream repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:02.
Original description (NVD)
A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format (RTF) data. Because the application fails to properly validate input buffer boundaries before copying data in get_rtf_data_from_buf(), reading beyond the allocated memory occurs. This flaw can cause the application to crash, leading to a Denial of Service (DoS), or leak sensitive memory contents into extracted output files.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.