ytnef CVE-2026-111145

Exploitation requires that the parsed TNEF stream contain an uncompressed RTF stream carried in a PT_BINARY MAPI property, where DecompressRTF() trusts the attacker-declared uncompressedSize without bounds-checking it against the actual buffer. The attacker must get the crafted winmail.dat in front of a caller - ytnefprint or any application linking libytnef - and that caller must actually process the attachment (UI:P, passive user interaction). Limiting factors: the attack vector is local/file-based (AV:L), not remotely reachable over a network service; no authentication or privileges are needed (PR:N); and impact is bounded to a crash (DoS) plus limited adjacent-heap disclosure rather than code execution. Realistic risk concentrates in mail gateways, converters, or forensic tooling that auto-ingest TNEF attachments.

This is a moderate, not top-tier, priority. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, score 6.9) describes a local, low-complexity, unauthenticated flaw that nonetheless requires passive user interaction - a victim must feed a crafted winmail.dat to ytnefprint or a libytnef-backed caller. Impact is split: confidentiality is only Low (adjacent heap bytes leaked, a CWE-125 out-of-bounds read, not arbitrary memory disclosure) while availability is High (reliable crash of the parser). There is no KEV listing and no EPSS score in the provided data, so widespread automated exploitation is not evidenced; however, a public exploit write-up (hackmd POC) and a VulnCheck advisory confirm working exploit code exists, making opportunistic or targeted use plausible against systems that auto-process TNEF attachments. Net: a real but contained bug - primarily a denial-of-service and limited info-leak in a niche parsing library, not a remote code execution or network-exposed issue. No EPSS or KEV data was supplied, so exploitation likelihood is inferred only from POC existence; verify EPSS before final prioritization.

An attacker emails a victim a winmail.dat TNEF attachment containing a crafted PT_BINARY MAPI property whose uncompressed RTF stream declares an oversized uncompressedSize. When the victim or an automated pipeline runs ytnefprint (or any libytnef caller) over the file, DecompressRTF() reads past the heap buffer, crashing the process and potentially leaking adjacent heap memory into output. A public proof-of-concept and write-up for this exact path already exist.