CVE-2026-62642

🗓️ 14 Jul 2026 15:49:17Reported by mitreType

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment.

Reporter	Title	Published	Views	Family All 6
Cvelist	CVE-2026-62642	14 Jul 202615:49	–	cvelist
EUVD	EUVD-2026-43747	14 Jul 202618:31	–	euvd
NVD	CVE-2026-62642	14 Jul 202616:17	–	nvd
Positive Technologies	PT-2026-58096	14 Jul 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-62642	14 Jul 202618:05	–	redhatcve
Vulnrichment	CVE-2026-62642	14 Jul 202615:49	–	vulnrichment

Vulners

CNA

Node

roundcube webmailRange1.6.0–1.6.17

roundcube webmailRange1.7.0–1.7.2

[
  {
    "defaultStatus": "unaffected",
    "product": "Webmail",
    "vendor": "Roundcube",
    "versions": [
      {
        "lessThan": "1.6.17",
        "status": "affected",
        "version": "1.6.0",
        "versionType": "semver"
      },
      {
        "lessThan": "1.7.2",
        "status": "affected",
        "version": "1.7.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
github	www.github.com/roundcube/roundcubemail/commit/877269c79359d959a94f13c9070cab0f3389c193
github	www.github.com/roundcube/roundcubemail/releases/tag/1.6.17
roundcube	www.roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2
github	www.github.com/roundcube/roundcubemail/commit/fb952956c6eaf29e963f1a718d028d66e7957ce0
github	www.github.com/roundcube/roundcubemail/commit/132ac8dd5a55c8466be12de1daf84355697ffa89
github	www.github.com/roundcube/roundcubemail/commit/a007321346380136b3de2bd75b486b04f63c0d38
github	www.github.com/roundcube/roundcubemail/releases/tag/1.7.2

14 Jul 2026 18:18Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.14.3

SSVC

CWE-835