CVE-2026-103680
mediumpriority · track · 26EPSS 0.003 · 25 %ileUSEPSS · scored 2026-10-28
A flaw was found in tnef. A heap-based buffer overflow can occur in the find_free_number() function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral Encapsulation Format (TNEF) file with an excessive number of colliding attachment filenames, causing the numeric counter to write past the allocated memory buffer. This issue may result in an application crash, leading to a Denial of Service (DoS), or potentially arbitrary code execution.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.1–6.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (1)
Products and version ranges known to be affected.
sources
Which sources assert this record, and when.
references (3) nvd
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/CVE-2026-103680Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2544478Issue TrackingThird Party Advisory
- https://github.com/verdammelt/tnefProduct
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan