Tnef Project
Monthly
Processing a crafted TNEF file with uncompressed RTF data through tnef can trigger an out-of-bounds read in get_rtf_data_from_buf(), causing a crash (denial of service) or opportunistic leakage of adjacent memory into extracted output. The affected product is the tnef Project’s tnef utility, matched by CPE cpe:2.3:a:tnef_project:tnef:*:*:*:*:*:*:*:*, with no version restriction in that CPE and no fixed version provided. Exploitation requires user interaction or an automated mail/attachment-extraction pipeline that feeds untrusted winmail.dat files to tnef; no public exploit has been identified at time of analysis, EPSS is low at 0.21% (9th percentile), and SSVC records exploitation as none, so this is a moderate rather than urgent priority consistent with the independent assessment.
Heap-based buffer overflow in the tnef command-line TNEF (winmail.dat) extractor allows a crafted TNEF file with a large number of colliding attachment filenames to overflow the numeric-suffix counter used by find_free_number(), producing a crash and denial of service; arbitrary code execution is theoretically possible but unproven. The bug only triggers under a non-default configuration in which numbered backups are enabled while file overwriting is disabled, and it requires the victim to actually run tnef against the malicious file (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L, base 3.1), so no public exploit code has been identified at time of analysis and real-world risk is low despite the RCE and memory-corruption tags attached to this report. Impact is limited to availability; there is no confidentiality or integrity impact in the assessed vector.
Extracting a specially crafted Transport Neutral Encapsulation Format (TNEF, "winmail.dat") file that contains multiple message bodies can crash the tnef utility through a use-after-free and double-free in its memory handling. The flaw is remotely reachable without credentials (PR:N), but exploitation depends on the malicious file actually reaching a tnef parsing step, which requires user interaction such as opening an email attachment or an automated mail gateway decoding it (UI:R). Impact is confined to availability - our independent assessment rates this as a modest-severity denial of service (A:L) rather than the vendor's higher 6.5 score, and no public exploit code and no confirmed active exploitation were identified at time of analysis.
In tnef before 1.4.18, an attacker may be able to write to the victim's .ssh/authorized_keys file via an e-mail message with a crafted winmail.dat application/ms-tnef attachment, because of a. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
An integer underflow has been identified in the unicode_to_utf8() function in tnef 1.4.14. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in tnef before 1.4.13. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
An issue was discovered in tnef before 1.4.13. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
An issue was discovered in tnef before 1.4.13. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
An issue was discovered in tnef before 1.4.13. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Processing a crafted TNEF file with uncompressed RTF data through tnef can trigger an out-of-bounds read in get_rtf_data_from_buf(), causing a crash (denial of service) or opportunistic leakage of adjacent memory into extracted output. The affected product is the tnef Project’s tnef utility, matched by CPE cpe:2.3:a:tnef_project:tnef:*:*:*:*:*:*:*:*, with no version restriction in that CPE and no fixed version provided. Exploitation requires user interaction or an automated mail/attachment-extraction pipeline that feeds untrusted winmail.dat files to tnef; no public exploit has been identified at time of analysis, EPSS is low at 0.21% (9th percentile), and SSVC records exploitation as none, so this is a moderate rather than urgent priority consistent with the independent assessment.
Heap-based buffer overflow in the tnef command-line TNEF (winmail.dat) extractor allows a crafted TNEF file with a large number of colliding attachment filenames to overflow the numeric-suffix counter used by find_free_number(), producing a crash and denial of service; arbitrary code execution is theoretically possible but unproven. The bug only triggers under a non-default configuration in which numbered backups are enabled while file overwriting is disabled, and it requires the victim to actually run tnef against the malicious file (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L, base 3.1), so no public exploit code has been identified at time of analysis and real-world risk is low despite the RCE and memory-corruption tags attached to this report. Impact is limited to availability; there is no confidentiality or integrity impact in the assessed vector.
Extracting a specially crafted Transport Neutral Encapsulation Format (TNEF, "winmail.dat") file that contains multiple message bodies can crash the tnef utility through a use-after-free and double-free in its memory handling. The flaw is remotely reachable without credentials (PR:N), but exploitation depends on the malicious file actually reaching a tnef parsing step, which requires user interaction such as opening an email attachment or an automated mail gateway decoding it (UI:R). Impact is confined to availability - our independent assessment rates this as a modest-severity denial of service (A:L) rather than the vendor's higher 6.5 score, and no public exploit code and no confirmed active exploitation were identified at time of analysis.
In tnef before 1.4.18, an attacker may be able to write to the victim's .ssh/authorized_keys file via an e-mail message with a crafted winmail.dat application/ms-tnef attachment, because of a. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
An integer underflow has been identified in the unicode_to_utf8() function in tnef 1.4.14. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in tnef before 1.4.13. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
An issue was discovered in tnef before 1.4.13. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
An issue was discovered in tnef before 1.4.13. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
An issue was discovered in tnef before 1.4.13. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.