CVE-2026-111145 in ytnef
Summary
by MITRE • 10/15/2026
ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in DecompressRTF() in lib/ytnef.c that never validates uncompressedSize for uncompressed RTF streams. Attackers can supply a crafted winmail.dat TNEF attachment with a malicious PT_BINARY MAPI property to crash ytnefprint or libytnef callers and leak adjacent heap memory.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in the ytnef library, specifically within versions up to 2.1.2, represents a critical security flaw rooted in improper input validation during the decompression of Rich Text Format streams. The core technical defect resides in the DecompressRTF function located in lib/ytnef.c, which fails to perform adequate bounds checking on the uncompressedSize variable when processing RTF data. This oversight allows an attacker who can supply a crafted winmail.dat TNEF attachment containing a malicious PT_BINARY MAPI property to exploit this logic error. The absence of validation means that the library proceeds with decompression operations without verifying whether the resulting data fits within the allocated memory buffers, leading directly to heap-based out-of-bounds read conditions.
From an operational perspective, this vulnerability poses significant risks to any application or service that utilizes libytnef for parsing Microsoft Outlook TNEF attachments. The immediate impact includes the potential crash of ytnefprint and other callers relying on the library, resulting in a denial of service condition. More critically, because the flaw involves reading memory beyond the intended buffer boundaries, it enables information disclosure attacks where adjacent heap memory contents can be leaked to an attacker. This leakage may expose sensitive data such as cryptographic keys, session tokens, or internal application states that reside in neighboring memory regions, thereby compromising the confidentiality and integrity of the host system.
This vulnerability aligns with Common Weakness Enumeration CWE-125, which describes out-of-bounds read vulnerabilities where software reads past the end of a buffer. In terms of attack vectors, this flaw facilitates exploitation techniques categorized under MITRE ATT&CK Tactic TA0043 Reconnaissance and potentially TA0005 Defense Evasion if used to bypass security controls by leaking memory contents. The specific mechanism involves manipulating MAPI properties within TNEF structures to trigger the faulty decompression logic, highlighting the importance of rigorous validation for all external inputs in email processing software.
To mitigate this risk, developers must update their dependencies to a patched version of ytnef that includes fixes for the DecompressRTF function. The remediation involves implementing strict bounds checking on the uncompressedSize variable before proceeding with memory allocation and decompression operations. Additionally, security teams should audit codebases using libytnef to ensure that all TNEF parsing paths enforce size limits consistent with allocated buffer capacities. Implementing fuzz testing against TNEF parsers can further help identify similar edge cases in input validation logic. Organizations relying on this library for email gateway solutions or client applications should prioritize immediate patching to prevent potential exploitation through maliciously crafted winmail.dat files distributed via phishing campaigns or compromised messaging systems.