VulnerabilityAnalyzed
CVE-2026-62642
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment.
MEDIUM 6.5EPSS 0.52%
Does this matter?
Lower severity and a low EPSS score (0.52%). Track it; it rarely justifies an emergency change on its own.
Description
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- EPSS
- 0.52% probability · 43th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-835
- Affected
- roundcube/webmail
- Source
- cve@mitre.org
References
- https://github.com/roundcube/roundcubemail/commit/132ac8dd5a55c8466be12de1daf84355697ffa89Patch
- https://github.com/roundcube/roundcubemail/commit/877269c79359d959a94f13c9070cab0f3389c193Patch
- https://github.com/roundcube/roundcubemail/commit/a007321346380136b3de2bd75b486b04f63c0d38Patch
- https://github.com/roundcube/roundcubemail/commit/fb952956c6eaf29e963f1a718d028d66e7957ce0Patch
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.17Release Notes
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.2Release Notes
- https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.