CVE catalog

CVE-2026-103680

A flaw was found in tnef. A heap-based buffer…

A flaw was found in tnef. A heap-based buffer overflow can occur in the find_free_number() function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral Encapsulation Format (TNEF) file with an excessive number of colliding attachment filenames, causing the numeric counter to write past the allocated memory buffer. This issue may result in an application crash, leading to a Denial of Service (DoS), or potentially arbitrary code execution.

Severity: Low · CVSS 3.1CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Published: Oct 1, 2026, 12:00:00 AM UTC
Updated: Oct 1, 2026, 12:17:15 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.32% · Oct 27, 2026

Projects and upstream resources

[tnef][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	tnef	Not reported	AffectedDistribution reports no fix	[CVE-2026-103680]
Debiantrixie	tnef	`1.4.18-4`	Affected	[CVE-2026-103680]
Debiansid	tnef	Not reported	AffectedDistribution reports no fix	[CVE-2026-103680]
Debiansid	tnef	`1.4.18-6`	Affected	[CVE-2026-103680]
Debianforky	tnef	Not reported	AffectedDistribution reports no fix	[CVE-2026-103680]
Debianforky	tnef	`1.4.18-6`	Affected	[CVE-2026-103680]
Debianbookworm	tnef	Not reported	AffectedDistribution reports no fix	[CVE-2026-103680]
Debianbookworm	tnef	`1.4.18-3`	Affected	[CVE-2026-103680]

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	tnef	Not reported	AffectedDistribution reports no fix	[CVE-2026-103680]
Debianbookworm	tnef	`1.4.18-3`	Affected	[CVE-2026-103680]
Debianforky	tnef	Not reported	AffectedDistribution reports no fix	[CVE-2026-103680]
Debianforky	tnef	`1.4.18-6`	Affected	[CVE-2026-103680]
Debiansid	tnef	Not reported	AffectedDistribution reports no fix	[CVE-2026-103680]
Debiansid	tnef	`1.4.18-6`	Affected	[CVE-2026-103680]
Debiantrixie	tnef	Not reported	AffectedDistribution reports no fix	[CVE-2026-103680]
Debiantrixie	tnef	`1.4.18-4`	Affected	[CVE-2026-103680]

Original provider fields

{
  "package_releases": [
    {
      "name": "tnef",
      "status": "vulnerable",
      "release": "sid",
      "version": "1.4.18-6"
    },
    {
      "name": "tnef",
      "status": "vulnerable",
      "release": "forky",
      "version": "1.4.18-6"
    },
    {
      "name": "tnef",
      "status": "vulnerable",
      "release": "trixie",
      "version": "1.4.18-4"
    },
    {
      "name": "tnef",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "1.4.18-3"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1149710,
      "name": "tnef",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "unimportant",
      "fixed_version": ""
    },
    {
      "bug": 1149710,
      "name": "tnef",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "unimportant",
      "fixed_version": ""
    },
    {
      "bug": 1149710,
      "name": "tnef",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": ""
    },
    {
      "bug": 1149710,
      "name": "tnef",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "tnef",
      "ranges": [
        {
          "fixed": "",
          "introduced": "",
          "last_affected": "1.4.18",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103680",
      "fixed_version": "",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-103680",
      "provider_updated_at": "2026-10-05T13:42:10.633"
    }
  ]
}

[Debian bug #1149710]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[tnef]Unknown
Details (2)
- 1.4.18-3 · amd64 · bookworm
  Affected
  nvd · tnef · debian · bookworm; nvd · tnef · debian · 12
- 1.4.18-3 · arm64 · bookworm
  Affected
  nvd · tnef · debian · bookworm; nvd · tnef · debian · 12

[Debian 13 (Trixie)]

[tnef]Unknown
Source package: [tnef]
Details (2)
- 1.4.18-4 · amd64 · trixie
  Affected
  nvd · tnef · debian · 13
- 1.4.18-4+b1 · arm64 · trixie
  Affected
  nvd · tnef · debian · 13

Observed: Oct 23, 2026, 7:46:41 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]