CVE-2026-103679
published 2026-10-01CVE-2026-103679: A flaw was found in tnef. A remote attacker could exploit this vulnerability by providing a specially crafted Transport Neutral Encapsulation Format (TNEF)…
PriorityP431medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.28%
20.2th percentile
A flaw was found in tnef. A remote attacker could exploit this vulnerability by providing a specially crafted Transport Neutral Encapsulation Format (TNEF) file containing multiple message bodies. During extraction, improper memory management triggers a use-after-free and double-free condition, causing the application to crash and resulting in a Denial of Service (DoS).
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| tnef_project | tnef | <= 1.4.18 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-103679 tnef: Use-after-free and double-free in get_body_files() via multi-value body extraction [fedora-all]
bugzilla·2026-10-01·CVSS 6.5
CVE-2026-103679 [MEDIUM] CVE-2026-103679 tnef: Use-after-free and double-free in get_body_files() via multi-value body extraction [fedora-all]
CVE-2026-103679 tnef: Use-after-free and double-free in get_body_files() via multi-value body extraction [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in tnef. When a TNEF stream contains more than one MAPI RTF or HTML body value, get_body_files() allocates a single filename buffer and a single MIME-type buffer and assigns the same pointers to every generated output file, instead of a separate copy per file. Each of these files is later freed independently, producing a use-after-free followed by a double-free on the second and subsequent files. The issue was confirmed under AddressSa
Bugzilla
CVE-2026-103679 tnef: Use-after-free and double-free in get_body_files() via multi-value body extraction
bugzilla·2026-10-01·CVSS 6.5
CVE-2026-103679 [MEDIUM] CVE-2026-103679 tnef: Use-after-free and double-free in get_body_files() via multi-value body extraction
CVE-2026-103679 tnef: Use-after-free and double-free in get_body_files() via multi-value body extraction
A flaw was found in tnef. When a TNEF stream contains more than one MAPI RTF or HTML body value, get_body_files() allocates a single filename buffer and a single MIME-type buffer and assigns the same pointers to every generated output file, instead of a separate copy per file. Each of these files is later freed independently, producing a use-after-free followed by a double-free on the second and subsequent files. The issue was confirmed under AddressSanitizer and crashes the process when extracting a crafted TNEF stream with multiple body values; no code-execution primitive has been demonstrated.
2026-10-01
Published