tnef EUVD-2026-90772

Requires the victim to extract/process an attacker-supplied TNEF (Transport Neutral Encapsulation Format, 'winmail.dat') file that specifically contains multiple message bodies - this crafted multi-body structure is the trigger condition. Exploitation is limited by required user interaction or automated processing (UI:R): the file must reach a tnef extraction step, typically via an email attachment opened by a user or auto-decoded by a mail gateway. No authentication is needed on the target (PR:N), but there is no network-service listening component - tnef is a client/utility file parser, so the attack depends entirely on getting the malicious file ingested. Impact is confined to crashing the extraction process (availability only); no confidentiality or integrity impact is indicated.

This is a genuine but modest-severity denial-of-service issue, not a high-priority remote code execution case despite the CWE-416 (use-after-free) and double-free classification. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H = 6.5 MEDIUM) shows the network reachability comes only through delivering a malicious file that a victim must process (UI:R), and the impact is strictly availability (C:N/I:N) - the stated outcome is an application crash. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis.' A use-after-free/double-free can sometimes be escalated beyond a crash, but neither the description nor the references claim memory-disclosure or code-execution impact, so treating this as DoS-only is correct. One signal to reconcile: the vendor-supplied A:H (high availability impact) is generous for a transient crash of a per-invocation command-line extraction utility - in practice the failure affects only the single parsing process, so real availability impact is closer to A:L; verify against how tnef is deployed (interactive vs. automated mail-gateway pipeline) before prioritizing.

An attacker crafts a malicious winmail.dat / TNEF file containing multiple message bodies and emails it to a victim or feeds it into an automated mail-processing pipeline. When the recipient or server extracts the attachment with tnef, improper memory management triggers a use-after-free and double-free, crashing the extraction process and denying that extraction. No public exploit code was identified, and successful triggering requires the victim to actually process the attacker-supplied file (UI:R).