What is the CVSS score of CVE-2026-62642?

CVE-2026-62642 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-62642?

Yes, a patch is available for CVE-2026-62642. Update the affected software to the latest version immediately.

Roundcube Webmail CVE-2026-62642

EUVD-2026-43747 MEDIUM

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2026-07-14 mitre

GHSA-345h-r9m2-jr4p

Denial Of Service Roundcube Webmail Suse

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (mitre) PRIMARY

MEDIUM

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

4.3 MEDIUM

Network-reachable parser flaw triggered by opening an email (UI:R, PR:N); no authentication needed; impact is availability-only and scoped to the vulnerable system (A:L, S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (mitre).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Jul 20, 2026 - 13:07 NVD

4.3 (MEDIUM) 6.5 (MEDIUM)

Patch available

Jul 14, 2026 - 18:20 EUVD

Source Code Evidence Fetched

Jul 14, 2026 - 16:35 vuln.today

Analysis Generated

Jul 14, 2026 - 16:35 vuln.today

DescriptionNVD

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment.

AnalysisAI

Roundcube Webmail's TNEF (winmail.dat) decoder enters an infinite loop when processing a specially crafted TNEF attachment, causing denial of service for users on affected installations. Versions before 1.6.17 and 1.7.x before 1.7.2 are confirmed affected per the vendor advisory issued 2026-07-05. No public exploit code and no active exploitation (CISA KEV) have been identified; the CVSS vector confirms user interaction is required, limiting automatable mass exploitation.

Technical ContextAI

Roundcube is a widely deployed open-source PHP webmail client (CPE: cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*). TNEF (Transport Neutral Encapsulation Format) is a proprietary Microsoft encoding used by Outlook to bundle attachments and message properties, commonly appearing as winmail.dat files. The root cause is CWE-835 (Loop with Unreachable Exit Condition): the TNEF parser reaches a state from which the exit condition can never be satisfied, consuming CPU indefinitely. The 1.7.2 release notes also reference a related DoS via crafted compressed-RTF size within TNEF files, suggesting the TNEF parsing subsystem had multiple length/termination logic issues addressed in the same release cycle.

RemediationAI

Upgrade to Roundcube Webmail 1.6.17 (1.6.x branch) or 1.7.2 (1.7.x branch), both confirmed patched releases per the vendor advisory at https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2 and the GitHub commits 877269c79359d959a94f13c9070cab0f3389c193, fb952956c6eaf29e963f1a718d028d66e7957ce0, a007321346380136b3de2bd75b486b04f63c0d38, and 132ac8dd5a55c8466be12de1daf84355697ffa89. If immediate patching is not feasible, a compensating control is to configure an upstream mail gateway or antivirus filter to strip or quarantine winmail.dat (TNEF) attachments before delivery to Roundcube; note this will block legitimate Outlook-generated attachments and may disrupt user workflows. No other workaround within Roundcube itself has been documented by the vendor.