Description
ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in DecompressRTF() in lib/ytnef.c that never validates uncompressedSize for uncompressed RTF streams. Attackers can supply a crafted winmail.dat TNEF attachment with a malicious PT_BINARY MAPI property to crash ytnefprint or libytnef callers and leak adjacent heap memory.
Published: 2026-10-15
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in DecompressRTF() in lib/ytnef.c that never validates uncompressedSize for uncompressed RTF streams. Attackers can supply a crafted winmail.dat TNEF attachment with a malicious PT_BINARY MAPI property to crash ytnefprint or libytnef callers and leak adjacent heap memory.
Title ytnef through 2.1.2 Heap Out-of-Bounds Read via DecompressRTF
First Time appeared Ytnef Project
Ytnef Project ytnef
Weaknesses CWE-125
CPEs cpe:2.3:a:ytnef_project:ytnef:*:*:*:*:*:*:*:*
Vendors & Products Ytnef Project
Ytnef Project ytnef
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Ytnef Project Ytnef
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-15T18:57:36.084Z

Reserved: 2026-10-15T17:03:58.228Z

Link: CVE-2026-111145

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-15T19:17:28.873

Modified: 2026-10-15T19:17:28.873

Link: CVE-2026-111145

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses