CVE-2026-103680
A heap-based buffer overflow can occur in the find_free_number() function when generating numbered backup suffixes for duplicate filenames.
Does this matter?
Lower severity and a low EPSS score (0.32%). Track it; it rarely justifies an emergency change on its own.
Description
A flaw was found in tnef. A heap-based buffer overflow can occur in the find_free_number() function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral Encapsulation Format (TNEF) file with an excessive number of colliding attachment filenames, causing the numeric counter to write past the allocated memory buffer. This issue may result in an application crash, leading to a Denial of Service (DoS), or potentially arbitrary code execution.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- EPSS
- 0.32% probability · 25th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-787
- Affected
- tnef project/tnef
- Source
- patrick@puiterwijk.org
EPSS moved from 0.3% on 2 October 2026 to 0.3% on 26 October 2026.
References
- https://access.redhat.com/security/cve/CVE-2026-103680Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2544478Issue Tracking, Third Party Advisory
- https://github.com/verdammelt/tnefProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.