← All credits

Red Hat would like to thank Julien Ahrens (RCE Security GmbH) for reporting this issue.

3 vulnerability records and advisories credit this contributor.

CVE-2026-103678

Tnef: heap out-of-bounds read in get_rtf_data_from_buf() via uncompressed rtf mapi value

CVE-2026-103679

Tnef: use-after-free and double-free in get_body_files() via multi-value body extraction

CVE-2026-103680

Tnef: heap buffer overflow in find_free_number() via numbered-backup suffix generation