CVE-2026-103678 is a Medium severity out-of-bounds read in tnef, the program that unpacks Microsoft TNEF mail attachments. A crafted file with uncompressed RTF data makes get_rtf_data_from_buf() read past its buffer, which can crash the program or leak memory into output files. No fixed version is confirmed, so check your distribution.
What's affected
- Product: tnef, a program for unpacking application/ms-tnef attachments, from the verdammelt/tnef project.
- Affected: versions are not listed in the record. The sources I read give no affected or fixed versions.
- Fixed: not confirmed. Check the project repository and your distribution's security tracker.
- Red Hat: its CVE page says this issue does not affect any currently supported Red Hat product.
- Score: CVSS 5.4, Medium.
How to check if you're exposed
Find out whether tnef is installed anywhere that handles mail.
command -v tnef
tnef --version
dpkg -l | grep -i tnef
rpm -qa | grep -i tnef
The usual places are mail gateways, ticketing systems, document pipelines and scanning appliances, where tnef is called on winmail.dat attachments. Search scripts and configuration for calls to the tnef command. Also check container images used for mail processing.
Then note how the tool is used. The Red Hat bugzilla entry says the memory over read can reach an extracted output file when body extraction is enabled, so a pipeline that saves the body is more exposed than one that only lists contents.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads a manifest or lockfile and shows which packages carry known CVEs, including this one. Nothing is installed and nothing leaves your browser session beyond the scan itself.
What to do now
- Find every system that runs tnef on mail attachments, especially automated ones.
- Check your distribution's security tracker and the project repository for a fixed version, and install it when it appears.
- Run tnef as an unprivileged user, in a sandbox or container with no access to sensitive files and with a time and memory limit.
- Avoid body extraction on untrusted mail until a fix is in place, if your workflow allows it.
- Treat the output files as untrusted, since the advisory says they could contain leaked memory contents.
- If tnef is not needed, remove it.
Why it matters
The record lists CWE-125, out-of-bounds read. The Red Hat bug report explains the cause: the handler for uncompressed RTF values copies a number of bytes taken from the file without checking that the buffer really holds that many bytes after the header. The size comes from the attacker and the check is missing.
The result is either a crash or an information leak. A crash is a denial of service for whatever mail pipeline is running the tool. A leak is more subtle: bytes from heap memory end up in an output file, which could include data from earlier processing in the same process.
The bug report says the issue was confirmed under AddressSanitizer. The record does not list the CVE as exploited in the wild. Mail attachment parsers are classic targets because they process content from strangers by design.
Quick check
Does this affect Red Hat systems?
Red Hat's page says the issue does not affect any currently supported Red Hat product. Other distributions may differ, so check yours.
What is the risk beyond a crash?
The bug report says that with body extraction enabled, memory contents past the buffer can be written into the extracted RTF output file.
Sources
Last reviewed: 18 October 2026.
