Skip to content
OpenAdvisories
Medium · 5.4 CVE-2026-103678 EUVD-2026-90771GHSA-8r4j-263j-fh85

Tnef: heap out-of-bounds read in get_rtf_data_from_buf() via uncompressed rtf mapi value

Published Oct 1, 2026 · Updated Oct 1, 2026 · Assigned by fedora

Description

A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format (RTF) data. Because the application fails to properly validate input buffer boundaries before copying data in get_rtf_data_from_buf(), reading beyond the allocated memory occurs. This flaw can cause the application to crash, leading to a Denial of Service (DoS), or leak sensitive memory contents into extracted output files.

Affected products

VendorProductAffectedFixed
— tnef ≤ 1.4.18 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 tnef No fix yet —
Debian 13 tnef No fix yet —
Debian 12 tnef No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 tnef No fix yet —
Ubuntu 26.04 LTS tnef No fix yet —
Ubuntu 24.04 LTS tnef No fix yet —
Ubuntu 22.04 LTS tnef No fix yet —
Ubuntu 20.04 LTS tnef No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS tnef No fix yet —
Ubuntu 16.04 LTS tnef No fix yet —

References