CVE-2017-9146: Buffer Overflow
Last updated 26 August 2025
Other sources
The TNEFFillMapi function in lib/ytnef.c in libytnef in ytnef through 1.9.2 does not ensure a nonzero count value before a certain memory allocation, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted tnef file.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-9146?
CVE-2017-9146 has been classified as a high severity vulnerability due to its potential to cause denial of service through a heap-based buffer overflow.
How do I fix CVE-2017-9146?
To fix CVE-2017-9146, you should upgrade to libytnef version 1.5-6ubuntu0.2 for Ubuntu or version 1.9.3-1 for other distributions.
What types of attacks can be executed due to CVE-2017-9146?
CVE-2017-9146 can allow remote attackers to execute a denial of service attack, possibly leading to heap-based buffer overflow and application crashes.
Which software is affected by CVE-2017-9146?
CVE-2017-9146 affects the libytnef library in versions prior to 1.9.3 and includes various distributions like Ubuntu and Debian.
Is CVE-2017-9146 exploit public?
Yes, the details of CVE-2017-9146 are public, allowing attackers to potentially exploit the vulnerability if systems are not patched.