ytnef CVE-2026-111146

Exploitation requires that a victim or automated workflow invoke ytnefprint (or an application using libytnef's MAPIPrint) on an attacker-supplied winmail.dat whose compressed RTF MAPI property decompresses to data lacking a trailing NUL terminator, so printf runs off the end of the heap allocation. Limiting factors: the attack vector is local file processing (not network-triggered), it requires user interaction or an automated parsing step to open the malicious file, the product is a niche TNEF decoder, and affected versions are ytnef through 2.1.2. The primary realistic outcome is a crash (denial of service) with incidental disclosure of small amounts of adjacent heap memory.

Signals point to a real but low-urgency issue. The vendor-supplied CVSS 4.0 vector (6.9, Medium) is AV:L/AC:L/PR:N/UI:P, meaning exploitation is local and depends on a victim passively processing an attacker-supplied file rather than a remote, self-propagating attack. Primary impact is availability (VA:H - ytnefprint crashes) with only limited confidentiality exposure (VC:L - adjacent heap bytes leaked), and no integrity impact. Public exploit code exists (VulnCheck advisory plus a hackmd write-up), which raises the practical likelihood of opportunistic use, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation. The local vector and required user interaction make this a targeted/opportunistic DoS-plus-minor-leak rather than a mass-exploitation threat. Net: a genuine vulnerability worth patching in environments that automate winmail.dat parsing, but not an emergency for most organizations. Missing data to note explicitly: EPSS probability is absent, so exploitation likelihood cannot be quantified; no vendor patch version is confirmed (issue #112 appears open), so remediation may require upstream code fixes rather than a version bump.

An attacker emails or otherwise delivers a crafted winmail.dat (TNEF) file containing a compressed RTF MAPI property whose decompressed output lacks a NUL terminator. When a victim or an automated pipeline runs ytnefprint (or software linking libytnef's MAPIPrint) against the file, printf over-reads past the heap buffer, crashing the process and potentially disclosing adjacent heap bytes. A public proof-of-concept and write-up already exist, lowering the barrier to reproduction.