CVE-2026-103680
published 2026-10-01CVE-2026-103680: A flaw was found in tnef. A heap-based buffer overflow can occur in the find_free_number() function when generating numbered backup suffixes for duplicate…
PriorityP433medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.32%
25.0th percentile
A flaw was found in tnef. A heap-based buffer overflow can occur in the find_free_number() function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral Encapsulation Format (TNEF) file with an excessive number of colliding attachment filenames, causing the numeric counter to write past the allocated memory buffer. This issue may result in an application crash, leading to a Denial of Service (DoS), or potentially arbitrary code execution.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| tnef_project | tnef | <= 1.4.18 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-103680 tnef: Heap buffer overflow in find_free_number() via numbered-backup suffix generation
bugzilla·2026-10-01·CVSS 3.1
CVE-2026-103680 [LOW] CVE-2026-103680 tnef: Heap buffer overflow in find_free_number() via numbered-backup suffix generation
CVE-2026-103680 tnef: Heap buffer overflow in find_free_number() via numbered-backup suffix generation
A flaw was found in tnef. find_free_number() allocates a fixed-size buffer sized for a 5-digit numeric backup suffix, but formats the counter with an unbounded sprintf(). When the --number-backups option is enabled and overwrite is disabled, a crafted TNEF stream that forces roughly 100,000 colliding candidate filenames for a single extracted attachment causes the counter to require six digits, writing past the end of the allocated heap buffer. The issue requires a non-default command-line option and a large, specially crafted input to trigger.
Bugzilla
CVE-2026-103680 tnef: Heap buffer overflow in find_free_number() via numbered-backup suffix generation [fedora-all]
bugzilla·2026-10-01·CVSS 3.1
CVE-2026-103680 [LOW] CVE-2026-103680 tnef: Heap buffer overflow in find_free_number() via numbered-backup suffix generation [fedora-all]
CVE-2026-103680 tnef: Heap buffer overflow in find_free_number() via numbered-backup suffix generation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in tnef. find_free_number() allocates a fixed-size buffer sized for a 5-digit numeric backup suffix, but formats the counter with an unbounded sprintf(). When the --number-backups option is enabled and overwrite is disabled, a crafted TNEF stream that forces roughly 100,000 colliding candidate filenames for a single extracted attachment causes the counter to require six digits, writing past the end of the allocated heap buffer. The issue
2026-10-01
Published