EUVD-2026-90771
GHSA-8r4j-263j-fh85
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted TNEF/RTF file to target
-
ExploitVictim or pipeline runs tnef to extract
-
ExecutionTrigger out-of-bounds read in get_rtf_data_from_buf()
-
ImpactCrash process or leak adjacent memory into output files
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that tnef be run against an attacker-supplied TNEF file whose embedded RTF stream is in the uncompressed form parsed by get_rtf_data_from_buf(); the crafted file must reach the parser, so a victim action or an automated mail/attachment-extraction pipeline that feeds untrusted winmail.dat files to tnef is the triggering condition (CVSS UI:R). Limiting factors: this is a client-side/batch decoder rather than a listening network service, impact is a crash or bounded adjacent-memory leak (not code execution or integrity loss, I:N), exploitation is non-automatable per SSVC, and the leaked data is opportunistic rather than attacker-controlled. |
| Impact | Signals are consistent and point to a moderate, not urgent, priority. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H, base 8.1) looks inflated for the described bug: the 'network' vector is nominal because tnef is a command-line/mail-pipeline decoder, so AV:N really means 'attacker-supplied file reaches the parser,' and UI:R correctly captures that a victim must process a crafted winmail.dat/RTF file - there is no self-propagating remote service. The underlying defect (CWE-125 out-of-bounds read in get_rtf_data_from_buf()) yields a crash (DoS) and possible adjacent-memory disclosure into extracted output, which is a partial impact rather than the C:H/A:H the score implies. Every lower-level framework agrees with the 'partial' read: EPSS is 0.21% (9th percentile), and CISA SSVC records Exploitation=none, Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no public exploit identified at time of analysis. Net: a legitimate memory-safety bug worth patching on mail-processing hosts, but not a drop-everything issue - the headline 8.1 overstates real-world risk versus the EPSS/SSVC consensus of low, non-automatable, partial-impact exploitation. |
| Exploit ScenarioDerived | An attacker emails or otherwise delivers a crafted TNEF attachment (e.g. winmail.dat) containing malformed uncompressed RTF data to a system where tnef is invoked to extract attachments. When the victim or an automated mail pipeline runs tnef on the file, get_rtf_data_from_buf() reads past the allocated buffer, crashing the process (DoS) or writing leaked heap/stack memory into the extracted output files. No public exploit code is identified at time of analysis, and user/pipeline interaction (processing the file) is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 05, 2026
Processing a crafted TNEF file with uncompressed RTF data through tnef can trigger an out-of-bounds read in get_rtf_data_from_buf(), causing a crash (denial of service) or opportunistic leakage of adjacent memory into extracted output. The affected product is the tnef Project’s tnef utility, matched by CPE cpe:2.3:a:tnef_project:tnef:*:*:*:*:*:*:*:*, with no version restriction in that CPE and no fixed version provided. Exploitation requires user interaction or an automated mail/attachment-extraction pipeline that feeds untrusted winmail.dat files to tnef; no public exploit has been identified at time of analysis, EPSS is low at 0.21% (9th percentile), and SSVC records exploitation as none, so this is a moderate rather than urgent priority consistent with the independent assessment.
Earlier versions of this analysis (1)
Out-of-bounds read in tnef's get_rtf_data_from_buf() during processing of uncompressed RTF data allows an attacker to crash the application or leak sensitive memory contents into extracted output files. The flaw (CWE-125) affects the tnef utility and requires user interaction to process a malicious TNEF file. No public exploit or active exploitation has been identified, and the CVSS score is 5.4 (moderate), making this a low-priority issue for mass exploitation.
RemediationAI
No vendor-released patch identified at time of analysis; monitor the Red Hat CVE page, Bugzilla 2544476, and the upstream GitHub repository at https://github.com/verdammelt/tnef for a fixed tnef release, and apply it as soon as one is available. Until then, block or quarantine TNEF/winmail.dat attachments at the mail gateway, for example by filtering application/ms-tnef or files named winmail.dat, and disable automatic TNEF extraction in mail clients or attachment-processing pipelines; the trade-off is that legitimate Outlook rich-text formatting and embedded TNEF content may be lost. If tnef must process untrusted TNEF files, run it only inside a sandboxed, least-privilege container with strict memory limits and no access to sensitive files, accepting added latency and possible benign failures on large legitimate attachments. Avoid feeding untrusted winmail.dat files to tnef from automated mail or attachment-extraction jobs, and monitor for crashes; because no public exploit has been identified and SSVC marks exploitation as none, these compensating controls are proportionate while awaiting a patch.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a CWE-125 out-of-bounds read in tnef, a decoder for Transport Neutral Encapsulation Format (TNEF), the Microsoft format commonly used for winmail.dat attachments from Outlook/Exchange. The vulnerable path, get_rtf_data_from_buf(), handles uncompressed Rich Text Format (RTF) data embedded in a TNEF file and fails to validate input buffer boundaries before copying, allowing reads beyond the allocated buffer. The CPE cpe:2.3:a:tnef_project:tnef:*:*:*:*:*:*:*:* identifies the tnef Project’s tnef codebase as the affected component, and tags indicate Buffer Overflow, Denial Of Service, and Information Disclosure. Although the supplied CVSS vector is 8.1 with C:H/I:N/A:H, the independent assessment rates the actual impact lower at CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, emphasizing a crash or bounded adjacent-memory leak rather than code execution or integrity loss; SSVC likewise lists technical impact as partial and exploitation as none, and non-automatable.
Know when Tnef gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
File must be processed by the decoder so UI:R; an out-of-bounds read yields only bounded memory disclosure (C:L) and a utility crash (A:L), matching SSVC 'partial' impact, with no integrity effect.
Primary rating from Vendor (fedora).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format (RTF) data. Because the application fails to properly validate input buffer boundaries before copying data in get_rtf_data_from_buf(), reading beyond the allocated memory occurs. This flaw can cause the application to crash, leading to a Denial of Service (DoS), or leak sensitive memory contents into extracted output files.
Executive ViewAI
The tnef utility, which processes TNEF/winmail.dat attachments, contains a high-severity out-of-bounds read that can crash email attachment extraction or leak adjacent memory into extracted output. Organizations using tnef in mail gateways, helpdesk, or automated attachment pipelines are affected, making mail-processing disruption and potential exposure of sensitive memory contents the key business concerns. No public exploit identified at time of analysis and EPSS is low, so this is a moderate priority, but leadership should still act because no vendor-released patch is available and untrusted attachments remain a common attack path.
No vendor-released patch identified at time of analysis. Interim mitigations include blocking or quarantining winmail.dat/TNEF attachments at the email gateway, disabling automated tnef extraction, running tnef only in sandboxed least-privilege environments, monitoring for crashes and memory leakage in extracted output, and restricting access to extracted files.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)NVD
An integer underflow has been identified in the unicode_to_utf8() function in tnef 1.4.14. Rated critical severity (CVSS
In tnef before 1.4.18, an attacker may be able to write to the victim's .ssh/authorized_keys file via an e-mail message
An issue was discovered in tnef before 1.4.13. Rated high severity (CVSS 7.8), this vulnerability is no authentication r
An issue was discovered in tnef before 1.4.13. Rated high severity (CVSS 7.8), this vulnerability is no authentication r
An issue was discovered in tnef before 1.4.13. Rated high severity (CVSS 7.8), this vulnerability is no authentication r
An issue was discovered in tnef before 1.4.13. Rated high severity (CVSS 7.8), this vulnerability is no authentication r
Extracting a specially crafted Transport Neutral Encapsulation Format (TNEF, "winmail.dat") file that contains multiple
Heap-based buffer overflow in the tnef command-line TNEF (winmail.dat) extractor allows a crafted TNEF file with a large
Exploit-DB