CVE-2026-62641: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a crafted compressed-RTF size.

PriorityP427medium6.5CVSS 3.1

AVNACLPRNUIRSUCNINAH

EPSS

0.25%

17.0th percentile

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a crafted compressed-RTF size.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
roundcube	webmail	>= 1.6.0 < 1.6.17	1.6.17
roundcube	webmail	>= 1.7.0 < 1.7.2	1.7.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.