[ CVE-2026-103679 · Published 1 Oct 2026 ]

Vulnerability in Tnef Project tnef

CVSS 6.5 EPSS <1%No fix listed yet

[ Description ]Official description

A flaw was found in tnef. A remote attacker could exploit this vulnerability by providing a specially crafted Transport Neutral Encapsulation Format (TNEF) file containing multiple message bodies. During extraction, improper memory management triggers a use-after-free and double-free condition, causing the application to crash and resulting in a Denial of Service (DoS).

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

access.redhat.com/security/cve/CVE-2026-103679Third Party Advisory
bugzilla.redhat.com/show_bug.cgiIssue TrackingThird Party Advisory
github.com/verdammelt/tnefProduct