CVE-2026-111146: ytnef through 2.1.2 Heap Out-of-Bounds Read via MAPIPrint in lib/ytnef.c
ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint() that allows attackers to read past heap allocations by supplying compressed RTF properties. Attackers can deliver a crafted winmail.dat whose decompressed RTF lacks a NUL terminator, causing printf to over-read, crashing ytnefprint and leaking adjacent heap bytes.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that process attacker-supplied winmail.dat files with ytnef through 2.1.2 are exposed, particularly where ytnefprint is used to inspect or print message contents.
What does an attacker need to do to trigger the vulnerability?
An attacker needs to provide a crafted winmail.dat containing compressed RTF properties whose decompressed RTF data lacks a NUL terminator. User interaction is required according to the supplied vector, and exploitation is local.
What is the likely impact of successful exploitation?
The out-of-bounds read can crash ytnefprint, causing a denial of service. It can also disclose adjacent heap bytes through the printf over-read.
How can I determine whether my environment is affected?
Check whether ytnef version 2.1.2 or earlier is installed and whether it processes untrusted winmail.dat files. The vulnerable code path is MAPIPrint() in lib/ytnef.c when handling compressed RTF properties.