EUVD-2026-90773
GHSA-qr96-v34j-wcrq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted TNEF file via email
-
DeliveryVictim extracts with tnef (backups on, overwrite off)
-
ExploitColliding filenames overflow find_free_number() counter
-
ExecutionHeap buffer write past bounds
-
ImpactApplication crash / denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a NON-DEFAULT tnef configuration: numbered backups must be enabled AND file overwriting must be disabled - only then does find_free_number() generate the numbered suffixes that trigger the overflow. The attacker must supply a specially crafted TNEF file containing an excessive number of attachment entries with colliding (duplicate) filenames to drive the numeric counter past the allocated buffer. Exploitation further requires user/process interaction (UI:R): a victim must actually run tnef against the malicious file. These factors - non-default config dependency, AC:H crafting effort, and required interaction - sharply limit realistic exploitability; confirmed impact is a crash (DoS), with code execution only theoretical. |
| Impact | Real-world risk is LOW despite alarming 'RCE/Memory Corruption' tagging. The vendor CVSS 3.1 score is only 3.1 (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L), and the sole rated impact is A:L (limited availability/crash) - the description's 'potentially arbitrary code execution' is explicitly speculative and is NOT reflected in the assessed impact metrics. Three signals converge to suppress risk: AC:H (high complexity - requires crafting a TNEF file with an excessive number of colliding attachment filenames to overflow the counter), UI:R (a user or process must actively run tnef on the malicious file), and a hard non-default configuration gate (numbered backups enabled AND file overwriting disabled). No EPSS score, no CISA KEV listing, and no public exploit were provided. Signals are consistent - there is no conflict between CVSS and description except that the 'RCE' tag overstates the confirmed A:L impact. This is a high-CVSS-tagged-but-genuinely-low-real-risk issue: treat as routine patch hygiene, not an emergency. |
| Exploit ScenarioDerived | An attacker emails or otherwise delivers a crafted winmail.dat/TNEF file to a victim whose mail pipeline or workstation extracts attachments with tnef configured for numbered backups and no-overwrite. When tnef processes the file's large set of colliding attachment filenames, find_free_number() overruns the heap buffer, crashing the extractor (DoS) and theoretically - though unconfirmed - enabling code execution. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Heap-based buffer overflow in the tnef command-line TNEF (winmail.dat) extractor allows a crafted TNEF file with a large number of colliding attachment filenames to overflow the numeric-suffix counter used by find_free_number(), producing a crash and denial of service; arbitrary code execution is theoretically possible but unproven. The bug only triggers under a non-default configuration in which numbered backups are enabled while file overwriting is disabled, and it requires the victim to actually run tnef against the malicious file (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L, base 3.1), so no public exploit code has been identified at time of analysis and real-world risk is low despite the RCE and memory-corruption tags attached to this report. Impact is limited to availability; there is no confidentiality or integrity impact in the assessed vector.
RemediationAI
No vendor-released patch was identified at time of analysis, so primary remediation is configuration-based: do not run tnef in the vulnerable mode - avoid enabling numbered backups (the -N/--number-backups behavior) while overwrite protection is in force, since the overflow is only reachable when both settings combine. Allowing overwrite instead suppresses suffix generation but carries the trade-off of silently clobbering pre-existing files of the same name, so extract into a clean, empty, per-message directory rather than a populated one. Additional compensating controls: run tnef under a hardened sandbox or container with strict memory limits and no privileges (limits converting a heap corruption into a contained crash rather than code execution), strip or quarantine winmail.dat attachments at the mail gateway since legitimate business need for them is usually limited, and pre-scan TNEF files for an abnormal number of duplicate attachment filenames before invoking the extractor. Because the vector requires user interaction, user awareness for opening suspicious TNEF attachments is applicable, but blocking or sanitizing TNEF at the boundary is more reliable. Track the Red Hat CVE page (https://access.redhat.com/security/cve/CVE-2026-103680), the Red Hat Bugzilla entry (https://bugzilla.redhat.com/show_bug.cgi?id=2544478), and the upstream repository (https://github.com/verdammelt/tnef) for an updated package or upstream commit, and upgrade as soon as a fixed build is published.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TNEF (Transport Neutral Encapsulation Format) is Microsoft's proprietary container used by Outlook/Exchange to carry rich message content and attachments, typically delivered as a winmail.dat part; the tnef utility (upstream at github.com/verdammelt/tnef, packaged in Fedora and Red Hat Enterprise Linux) parses these files and extracts embedded attachments to disk. This issue is classified as CWE-787 (out-of-bounds write), specifically a heap-based buffer overflow in the find_free_number() routine, which builds the numbered backup suffix (for example, "name(2).ext") used to avoid clobbering existing files. When numbered backups are enabled and overwriting is disabled, the routine scans for the next available numeric suffix; an attacker-supplied TNEF file containing an excessive number of attachment entries that all resolve to the same colliding filename drives the counter value beyond the size of the buffer allocated to hold the suffix string, corrupting adjacent heap memory. The vulnerable path therefore depends on a non-default operational configuration (numbered backups on, overwrite off) rather than on the TNEF parser's default attachment-handling path, and the CVSS vector reflects this with AC:H and UI:R while PR:N indicates no authentication is needed to deliver the file.
Know when Tnef gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
AC:H and UI:R because exploitation needs a non-default backup config, a specially crafted many-collision file, and the victim running tnef on it; impact is crash-only, so A:L with C/I:N.
Primary rating from Vendor (fedora).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A flaw was found in tnef. A heap-based buffer overflow can occur in the find_free_number() function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral Encapsulation Format (TNEF) file with an excessive number of colliding attachment filenames, causing the numeric counter to write past the allocated memory buffer. This issue may result in an application crash, leading to a Denial of Service (DoS), or potentially arbitrary code execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)NVD
An integer underflow has been identified in the unicode_to_utf8() function in tnef 1.4.14. Rated critical severity (CVSS
In tnef before 1.4.18, an attacker may be able to write to the victim's .ssh/authorized_keys file via an e-mail message
Processing a crafted TNEF file with uncompressed RTF data through tnef can trigger an out-of-bounds read in get_rtf_data
An issue was discovered in tnef before 1.4.13. Rated high severity (CVSS 7.8), this vulnerability is no authentication r
An issue was discovered in tnef before 1.4.13. Rated high severity (CVSS 7.8), this vulnerability is no authentication r
An issue was discovered in tnef before 1.4.13. Rated high severity (CVSS 7.8), this vulnerability is no authentication r
An issue was discovered in tnef before 1.4.13. Rated high severity (CVSS 7.8), this vulnerability is no authentication r
Extracting a specially crafted Transport Neutral Encapsulation Format (TNEF, "winmail.dat") file that contains multiple
Exploit-DB