Threat database

ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint() that allows attackers to read past heap allocations by supplying compressed RTF properties. Attackers can deliver a crafted winmail.dat whose decompressed RTF lacks a NUL terminator, causing printf to over-read, crashing ytnefprint and leaking adjacent heap bytes.

ytnef versions up to 2.1.2 contain a heap out-of-bounds read vulnerability in the DecompressRTF() function. This flaw occurs because the uncompressedSize for uncompressed RTF streams is not validated, allowing crafted winmail.dat TNEF attachments with malicious PT_BINARY MAPI properties to cause crashes and potentially leak adjacent heap memory.