A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format… (CVE-2026-103678)

The tnef application contains a vulnerability identified as CVE-2026-103678, where improper validation of input buffer boundaries in the get_rtf_data_from_buf() function allows reading beyond allocated memory when processing specially crafted uncompressed RTF data. This flaw can be exploited by an attacker supplying a malicious file, resulting in application crashes (denial of service) or leakage of sensitive memory contents into extracted output files.

Successful exploitation can cause the tnef application to crash, resulting in denial of service, or lead to leakage of sensitive memory contents through output files. There is no indication of privilege escalation or remote code execution. The CVSS score of 8.1 reflects high confidentiality impact and high availability impact, with no integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor vendor advisories for updates and apply patches once available.