CVE-2026-103680

A heap-based buffer overflow exists in the tnef component within the find_free_number() function. The vulnerability occurs during the generation of numbered backup suffixes for duplicate filenames when numbered backups are enabled and file overwriting is disabled. An attacker can trigger this by ...

CVE-2026-103680 Tnef: heap buffer overflow in find_free_number() via numbered-backup suffix generation

A flaw was found in tnef. A heap-based buffer overflow can occur in the findfreenumber function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral...