A flaw was found in tnef. A heap-based buffer overflow can occur in the find_free_number() function when generating numbered backup suffixes for… (CVE-2026-103680)

The vulnerability in tnef (CVE-2026-103680) is a heap-based buffer overflow in the find_free_number() function. When numbered backups are enabled and file overwriting is disabled, supplying a specially crafted Transport Neutral Encapsulation Format (TNEF) file with excessive colliding attachment filenames causes the numeric counter to write beyond the allocated memory buffer. This can lead to application crashes or potentially arbitrary code execution.

Successful exploitation can cause the tnef application to crash, resulting in denial of service (DoS). There is also potential for arbitrary code execution, which could allow an attacker to execute malicious code within the context of the vulnerable application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted TNEF files with numbered backups enabled and file overwriting disabled to reduce risk.