CVE-2026-103678
Tnef: heap out-of-bounds read in get_rtf_data_from_buf() via uncompressed rtf mapi value
A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format (RTF) data. Because the application fails to properly validate input buffer boundaries before copying data in get_rtf_data_from_buf(), reading beyond the allocated memory occurs. This flaw can cause the application to crash, leading to a Denial of Service (DoS), or leak sensitive memory contents into extracted output files.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
5.4
Tnef: heap out-of-bounds read in get_rtf_data_from_buf() via uncompressed rtf mapi value
A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format (RTF) data. Because the application fails to properly validate input buffer boundaries before copying data in get_rtf_data_from_buf(), reading beyond the allocated memory occurs. This flaw can cause the application to crash, leading to a Denial of Service (DoS), or leak sensitive memory contents into extracted output files.
- Record
CVE-2026-103678- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2026-90771
5.4
A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format (RTF) data. Because the application fails to properly validate input buffer boundaries before copying data in get_rtf_data_from_buf(), reading beyond the allocated memory occurs. This flaw can cause the application to crash, leading to a Denial of Service (DoS), or leak sensitive memory contents into extracted output files.
- Record
EUVD-2026-90771- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8r4j-263j-fh85
5.4
A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially...
A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format (RTF) data. Because the application fails to properly validate input buffer boundaries before copying data in get_rtf_data_from_buf(), reading beyond the allocated memory occurs. This flaw can cause the application to crash, leading to a Denial of Service (DoS), or leak sensitive memory contents into extracted output files.
- Record
GHSA-8r4j-263j-fh85- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
5.4
A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format (RTF) data. Because the application fails to properly validate input buffer boundaries before copying data in get_rtf_data_from_buf(), reading beyond the allocated memory occurs. This flaw can cause the application to crash, leading to a Denial of Service (DoS), or leak sensitive memory contents into extracted output files.
- Record
CVE-2026-103678- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
5.4
Tnef: heap out-of-bounds read in get_rtf_data_from_buf() via uncompressed rtf mapi value
A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format (RTF) data. Because the application fails to properly validate input buffer boundaries before copying data in get_rtf_data_from_buf(), reading beyond the allocated memory occurs. This flaw can cause the application to crash, leading to a Denial of Service (DoS), or leak sensitive memory contents into extracted output files.
- Record
CVE-2026-103678- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-103678
8.1
A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format (RTF) data. Because the application fails to properly validate input buffer boundaries before copying data in get_rtf_data_from_buf(), reading beyond the allocated memory occurs. This flaw can cause the application to crash, leading to a Denial of Service (DoS), or leak sensitive memory contents into extracted output files.
- Record
DEBIAN-CVE-2026-103678- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-103678
5.4
A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format (RTF) data. Because the application fails to properly validate input buffer boundaries before copying data in get_rtf_data_from_buf(), reading beyond the allocated memory occurs. This flaw can cause the application to crash, leading to a Denial of Service (DoS), or leak sensitive memory contents into extracted output files.
- Record
UBUNTU-CVE-2026-103678- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tnefDebian:12 |
All versions, plus listed versions 1.4.18-31.4.18-41.4.18-51.4.18-6 |
None known |
tnefDebian:13 |
All versions, plus listed versions 1.4.18-41.4.18-51.4.18-6 |
None known |
tnefDebian:14 |
All versions, plus listed versions 1.4.18-41.4.18-51.4.18-6 |
None known |
tnefUbuntu:16.04:LTS |
All versions, plus listed versions 1.4.9-11.4.9-1+deb8u2build0.16.04.11.4.9-1+deb8u3build0.16.04.11.4.9-1+deb8u4build0.16.04.1 |
None known |
tnefUbuntu:18.04:LTS |
All versions, plus listed versions 1.4.12-1.2 |
None known |
tnefUbuntu:20.04:LTS |
All versions, plus listed versions 1.4.12-1.21.4.18-1 |
None known |
tnefUbuntu:22.04:LTS |
All versions, plus listed versions 1.4.18-3 |
None known |
tnefUbuntu:24.04:LTS |
All versions, plus listed versions 1.4.18-3 |
None known |
tnefUbuntu:26.10 |
All versions, plus listed versions 1.4.18-5build11.4.18-6 |
None known |
tnefUbuntu:26.04:LTS |
All versions, plus listed versions 1.4.18-51.4.18-5build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-103678 is a medium vulnerability (CVSS 5.4) in Tnef Project Tnef, published October 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 14th percentile. No source names a fixed version.
References
access.redhat.com/security/cve/CVE-2026-103678
bugzilla.redhat.com/show_bug.cgi?id=2544476
github.com/verdammelt/tnef
nvd.nist.gov/vuln/detail/CVE-2026-103678
github.com/advisories/GHSA-8r4j-263j-fh85
github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103678.json
security-tracker.debian.org/tracker/CVE-2026-103678
ubuntu.com/security/CVE-2026-103678
cve.org/CVERecord?id=CVE-2026-103678