CVE-2026-111146 in ytnef
Summary
by MITRE • 10/15/2026
ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint() that allows attackers to read past heap allocations by supplying compressed RTF properties. Attackers can deliver a crafted winmail.dat whose decompressed RTF lacks a NUL terminator, causing printf to over-read, crashing ytnefprint and leaking adjacent heap bytes.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in ytnef versions through 2.1.2 represents a critical memory safety flaw located within the MAPIPrint function, specifically triggered during the processing of Microsoft Outlook TNEF attachments commonly known as winmail.dat files. This issue is classified under CWE-125, which denotes an out-of-bounds read vulnerability where software reads data past the end or before the beginning of a buffer. The root cause lies in the handling of Rich Text Format properties that have been compressed using standard compression algorithms such as zlib. When ytnef decompresses these RTF streams to render them for printing, it fails to enforce strict boundary checks on string termination characters. Specifically, if the decompressed RTF content lacks a null terminator at its expected end position, the application continues reading memory beyond the allocated heap buffer until it encounters an arbitrary zero byte in adjacent memory space.
From a technical perspective, this flaw exploits the behavior of standard C library functions like printf which rely on null-terminated strings to determine string length. Because the decompressed RTF data does not include the required NUL character at its logical end, the printing routine interprets subsequent heap bytes as part of the payload. This results in a heap out-of-bounds read operation that can expose sensitive information stored in adjacent memory regions. The impact is twofold: first, it leads to application instability and crashes due to accessing invalid or protected memory addresses, resulting in denial of service conditions for users attempting to print TNEF attachments. Second, and more critically, the uncontrolled data exposure allows attackers to leak heap contents which may contain cryptographic keys, session tokens, passwords, or other confidential user data residing near the allocated buffer on the stack or heap.
This vulnerability aligns with ATT&CK technique T1059.007, Office Application Scripting, as it involves the exploitation of a legitimate office-related file format (TNEF/RTF) to execute malicious actions through memory corruption techniques. It also reflects aspects of CWE-200, Information Exposure, due to the potential for sensitive data leakage via side-channel effects from heap metadata or adjacent variables. The attack vector typically requires social engineering or automated delivery mechanisms where a victim opens an email containing a crafted winmail.dat attachment that triggers the vulnerable MAPIPrint function during preview or print operations in compatible mail clients utilizing ytnef libraries.
Mitigation strategies should prioritize immediate patching to version 2.1.3 or later, which addresses this boundary check deficiency by ensuring proper null-termination of decompressed RTF strings before passing them to printing routines. In environments where upgrading is not immediately feasible, administrators can implement input validation at the gateway level to strip or sanitize TNEF attachments from incoming emails. Additionally, enabling sandboxing for email clients and restricting print functionality within untrusted document viewers can reduce the attack surface by preventing direct interaction with vulnerable system libraries. Security teams should also monitor for anomalous memory access patterns in mail server logs that might indicate exploitation attempts targeting this specific heap overflow condition.