What is the CVSS score of CVE-2026-62641?

CVE-2026-62641 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-62641?

Yes, a patch is available for CVE-2026-62641. Update the affected software to the latest version immediately.

Roundcube Webmail CVE-2026-62641

EUVD-2026-43745 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-14 mitre

GHSA-wvvp-c8qh-3cc5

Denial Of Service Roundcube Webmail Suse

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (mitre) PRIMARY

MEDIUM

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

4.3 MEDIUM

Attack delivered via email over network (AV:N), user must open the attachment (UI:R), no attacker authentication needed (PR:N); only limited availability is impacted.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (mitre).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Jul 20, 2026 - 13:07 NVD

4.3 (MEDIUM) 6.5 (MEDIUM)

Patch available

Jul 14, 2026 - 18:20 EUVD

Source Code Evidence Fetched

Jul 14, 2026 - 16:35 vuln.today

Analysis Generated

Jul 14, 2026 - 16:35 vuln.today

DescriptionNVD

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a crafted compressed-RTF size.

AnalysisAI

Denial of service in Roundcube Webmail's TNEF decoder allows remote senders to crash the webmail parser by embedding a crafted compressed-RTF size field inside a winmail.dat attachment. Affected versions are all Roundcube Webmail releases before 1.6.17 and 1.7.x before 1.7.2. Release notes confirm the defect manifests as an infinite loop in the TNEF parser, meaning repeated delivery of malicious emails could degrade server availability for affected users. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.

Technical ContextAI

Roundcube Webmail includes a built-in TNEF (Transport Neutral Encapsulation Format) decoder to render winmail.dat attachments produced by Microsoft Outlook. TNEF payloads can embed RTF content in a compressed form; the decoder is expected to validate the declared compressed-RTF size before allocating resources or iterating. CWE-770 (Allocation of Resources Without Limits or Throttling) identifies the root cause: the decoder fails to bound the size field, enabling resource exhaustion or an infinite loop. The 1.7.2 release notes explicitly confirm 'Fix an infinite loop in TNEF (winmail.dat) decoder' alongside the DoS fix for crafted compressed-RTF size, indicating both defects reside in the same TNEF subsystem. The CPE cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:* indicates all prior Roundcube Webmail versions across both the 1.6.x stable and 1.7.x branches are affected.

RemediationAI

Upgrade to Roundcube Webmail 1.6.17 (stable branch) or 1.7.2 (latest branch), both released July 5, 2026 and available at https://github.com/roundcube/roundcubemail/releases/tag/1.6.17 and https://github.com/roundcube/roundcubemail/releases/tag/1.7.2 respectively; the vendor recommends backing up data before updating. The upstream fix commits are bf253c72d4293c93fda511b8464fe9cb34b522c1 for the 1.6.x branch and 6d1004fd3764a9606c53130b322c0f295c38be64 for the 1.7.x branch. If immediate patching is not feasible, a compensating control is to configure a mail gateway or antivirus filter to strip or quarantine emails containing winmail.dat attachments before they reach Roundcube's TNEF parser - note this will also block legitimate TNEF attachments from Outlook senders, which is a meaningful trade-off for organizations with heavy Outlook interoperability. No other specific workarounds are documented by the vendor.