CVE-2026-111145: ytnef through 2.1.2 Heap Out-of-Bounds Read via DecompressRTF
ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in DecompressRTF() in lib/ytnef.c that never validates uncompressedSize for uncompressed RTF streams. Attackers can supply a crafted winmail.dat TNEF attachment with a malicious PTBINARY MAPI property to crash ytnefprint or libytnef callers and leak adjacent heap memory.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using ytnef through 2.1.2 are exposed when they process attacker-controlled winmail.dat TNEF attachments. This includes ytnefprint and applications that call libytnef.
What does an attacker need to exploit it?
An attacker needs to provide a crafted winmail.dat attachment containing a malicious PT_BINARY MAPI property. The attack vector is local and requires user interaction, according to the supplied CVSS vector.
What is the potential impact?
Processing the crafted attachment can crash the affected parser or application and may disclose adjacent heap memory. The provided severity vector indicates low confidentiality impact and high availability impact, with no integrity impact.