This vulnerability in tnef allows an attacker to trigger an out-of-bounds read by supplying a maliciously crafted file with uncompressed RTF data. The root cause is a failure to properly validate buffer boundaries before copying data in the get_rtf_data_from_buf() function. Exploitation can lead to application crashes (DoS) or unintended disclosure of memory contents in extracted files.

Successful exploitation may cause the tnef application to crash, resulting in denial of service. Additionally, sensitive memory contents may be leaked into output files, potentially exposing confidential information. There is no indication of code execution or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-103678 for current remediation guidance. Until a fix is applied, avoid processing untrusted or specially crafted RTF files with tnef to mitigate risk.