Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-103680

Tnef Project Tnef: out-of-bounds write can lead to remote code execution

Risk score
44/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.3%
Published
1 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
A flaw was found in tnef. A heap-based buffer overflow can occur in the find_free_number() function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral Encapsulation Format (TN…
Affected
Tnef Project Tnef
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Tnef Project TnefTHE FLAWSTHE FIXCVE-2026-103680Out-of-bounds write can leadto remote code executionCVSS 6.5 · EPSS 0%CVE-2026-103678Out-of-bounds read can lead todenial of serviceCVSS 8.1 · EPSS 0%CVE-2026-103679Use-after-free can lead todenial of serviceCVSS 6.5 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedTnef Project TnefYELLOW · PLAN IT INTnef ProjectTnefA flaw was found in tnef. Anattacker can exploit thisvulnerability by providing aspecially crafted file containinguncompressed Rich Text Format(RTF) data. Because theapplication fails to properly…Where it standsNo known exploitationCONNECTS TOSame weaknessOut-of-bounds write (CWE-787)258 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Tnef Project Tnef: Yellow, plan it in. A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format (RTF) data. Because the application fails to properly validate input buffer boundaries before copying data in get_rtf_data_from_buf(), reading beyond the allocated memory …

The flaws

  • CVE-2026-103680: Out-of-bounds write can lead to remote code execution (CVSS 6.5 · EPSS 0%)
  • CVE-2026-103678: Out-of-bounds read can lead to denial of service (CVSS 8.1 · EPSS 0%)
  • CVE-2026-103679: Use-after-free can lead to denial of service (CVSS 6.5 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Tnef Project Tnef

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 6.5 medium

References

Original description

A flaw was found in tnef. A heap-based buffer overflow can occur in the find_free_number() function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral Encapsulation Format (TNEF) file with an excessive number of colliding attachment filenames, causing the numeric counter to write past the allocated memory buffer. This issue may result in an application crash, leading to a Denial of Service (DoS), or potentially arbitrary code execution.

Last activity 1 Oct 2026. Patch Forecast updates every hour.