CVE-2026-62642

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/roundcube/roundcubemail/commit/132ac8dd5a55c8466be12de1daf84355697ffa89	Patch
https://github.com/roundcube/roundcubemail/commit/877269c79359d959a94f13c9070cab0f3389c193	Patch
https://github.com/roundcube/roundcubemail/commit/a007321346380136b3de2bd75b486b04f63c0d38	Patch
https://github.com/roundcube/roundcubemail/commit/fb952956c6eaf29e963f1a718d028d66e7957ce0	Patch
https://github.com/roundcube/roundcubemail/releases/tag/1.6.17	Release Notes
https://github.com/roundcube/roundcubemail/releases/tag/1.7.2	Release Notes
https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:roundcube:webmail::::::::
	cpe:2.3:a:roundcube:webmail::::::::

History

No history.

Information

Published : 2026-07-14 16:17

Updated : 2026-07-20 12:55

NVD link : CVE-2026-62642

Mitre link : CVE-2026-62642

CVE.ORG link : CVE-2026-62642

JSON object : View

Products Affected

roundcube

webmail

CWE

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

{"id": "CVE-2026-62642", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62642", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T17:17:53.646785Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "Roundcube", "product": "Webmail", "versions": [{"status": "affected", "version": "1.6.0", "lessThan": "1.6.17", "versionType": "semver"}, {"status": "affected", "version": "1.7.0", "lessThan": "1.7.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-14T16:17:04.530", "references": [{"url": "https://github.com/roundcube/roundcubemail/commit/132ac8dd5a55c8466be12de1daf84355697ffa89", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/roundcube/roundcubemail/commit/877269c79359d959a94f13c9070cab0f3389c193", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/roundcube/roundcubemail/commit/a007321346380136b3de2bd75b486b04f63c0d38", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/roundcube/roundcubemail/commit/fb952956c6eaf29e963f1a718d028d66e7957ce0", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.17", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.2", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-835"}]}], "descriptions": [{"lang": "en", "value": "In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment."}], "lastModified": "2026-07-20T12:55:28.270", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BE3CB576-6905-4ED7-AAD5-C0523B5E6FFD", "versionEndExcluding": "1.6.17", "versionStartIncluding": "1.6.0"}, {"criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58061F28-9D4F-4D65-8C64-F77410B6E144", "versionEndExcluding": "1.7.2", "versionStartIncluding": "1.7.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}