CVE-2026-111146: Out-of-bounds Read in Yeraze ytnef

CVE-2026-111146 is a heap out-of-bounds read vulnerability in the ytnef utility (part of the Yeraze project) affecting versions up to and including 2.1.2. The vulnerability exists in the MAPIPrint() function, which processes compressed RTF properties within winmail.dat files. If an attacker supplies a specially crafted winmail.dat whose decompressed RTF data lacks a terminating NUL byte, the printf function reads beyond the allocated heap buffer. This results in a crash of ytnefprint and disclosure of adjacent heap memory contents.

An attacker can cause a denial of service by crashing ytnefprint and potentially leak sensitive information from adjacent heap memory. The vulnerability requires user interaction (UI:P) and local access (AV:L). There are no known exploits in the wild at this time. The CVSS 4.0 base score is 6.9, indicating a medium severity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or suspicious winmail.dat files with ytnef to reduce risk.