CVE-2026-103680

A flaw was found in tnef. A heap-based buffer overflow can occur in the find_free_number() function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral Encapsulation Format (TNEF) file with an excessive number of colliding attachment filenames, causing the numeric counter to write past the allocated memory buffer. This issue may result in an application crash, leading to a Denial of Service (DoS), or potentially arbitrary code execution.

CVSS v3 3.1 LOW

3.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2026-103680	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2544478	Issue Tracking Third Party Advisory
https://github.com/verdammelt/tnef	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:tnef_project:tnef:*:*:*:*:*:*:*:*

History

05 Oct 2026, 13:42

Type	Values Removed	Values Added
CPE		cpe:2.3:a:tnef_project:tnef::::::::
References	~~() https://access.redhat.com/security/cve/CVE-2026-103680 -~~	() https://access.redhat.com/security/cve/CVE-2026-103680 - Third Party Advisory
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=2544478 -~~	() https://bugzilla.redhat.com/show_bug.cgi?id=2544478 - Issue Tracking, Third Party Advisory
References	~~() https://github.com/verdammelt/tnef -~~	() https://github.com/verdammelt/tnef - Product
First Time		Tnef Project tnef Tnef Project

01 Oct 2026, 12:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-01 12:17

Updated : 2026-10-05 13:42

NVD link : CVE-2026-103680

Mitre link : CVE-2026-103680

CVE.ORG link : CVE-2026-103680

JSON object : View

Products Affected

tnef_project

tnef

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-103680", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-103680", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-01T14:57:56.123447Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "patrick@puiterwijk.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "patrick@puiterwijk.org", "affectedData": [{"versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.4.18"}], "packageName": "tnef", "collectionURL": "https://github.com/verdammelt/tnef", "defaultStatus": "unaffected"}]}], "published": "2026-10-01T12:17:15.810", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-103680", "tags": ["Third Party Advisory"], "source": "patrick@puiterwijk.org"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544478", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "patrick@puiterwijk.org"}, {"url": "https://github.com/verdammelt/tnef", "tags": ["Product"], "source": "patrick@puiterwijk.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "patrick@puiterwijk.org", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in tnef. A heap-based buffer overflow can occur in the find_free_number() function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral Encapsulation Format (TNEF) file with an excessive number of colliding attachment filenames, causing the numeric counter to write past the allocated memory buffer. This issue may result in an application crash, leading to a Denial of Service (DoS), or potentially arbitrary code execution."}], "lastModified": "2026-10-05T13:42:10.633", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tnef_project:tnef:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0971079-1960-4691-BA33-FDECDAAB7233", "versionEndIncluding": "1.4.18"}], "operator": "OR"}]}], "sourceIdentifier": "patrick@puiterwijk.org"}