CVE-2026-103678

A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format (RTF) data. Because the application fails to properly validate input buffer boundaries before copying data in get_rtf_data_from_buf(), reading beyond the allocated memory occurs. This flaw can cause the application to crash, leading to a Denial of Service (DoS), or leak sensitive memory contents into extracted output files.

• CWE-125

• https://access.redhat.com/security/cve/CVE-2026-103678
• https://bugzilla.redhat.com/show_bug.cgi?id=2544476
• https://github.com/verdammelt/tnef

Published

Oct 1, 2026

Last Modified

Oct 1, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-103651MISP contains a vulnerability in its one-time password (OTP)…7.6
• CVE-2026-103655MISP contains a vulnerability in its two-factor authenticati…9.3
• CVE-2026-103656Rejected reason: this is rejected
• CVE-2026-103659MISP contains an authorization bypass in the event flattenin…7.1
• CVE-2026-103662MISP contains a reflected cross-site scripting (XSS) vulnera…5.1
• CVE-2026-103664MISP contains a reflected cross-site scripting (XSS) vulnera…4.8
• CVE-2026-103679A flaw was found in tnef. A remote attacker could exploit th…6.5
• CVE-2026-103680A flaw was found in tnef. A heap-based buffer overflow can o…3.1
• CVE-2026-103686A flaw has been found in rhukster dom-sanitizer up to 1.0.15…3.5
• CVE-2026-103687A vulnerability has been found in rhukster dom-sanitizer up …7.3
• CVE-2026-103690A flaw has been found in itsourcecode Leave Management Syste…6.3
• CVE-2026-1037IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2…6.1