cve-2023-23397

CVE-2023-23397 이 스크립트는 CVE-2023-23397 익스플로이트 페이로드가 포함된 TNEF 인코딩 Outlook 이메일을 생성하고 순수 SMTP를 통해 전송할 수 있습니다. COM 개체나 EWS가 필요하지 않습니다. IPM.Schedule.Meeting.Request 메시지 클래스가 제대로 작동하지 않아 회의와 알림을 생성하지만 어떤 이유로 PidLidReminderOverride 속성을 준수하지 않음 대신 스크립트는 IPM.TaskRequest 클래스를 악용합니다. 그 결과 원래 익스플로이트와 마찬가지로 악성...

CVE-2020-1493

CVE-2020-1493 この脆弱性は、Windows 10 1909 x64 にインストールされた Outlook 2019 16.0.12624.20424 で発生します。また、この脆弱性は ゼロクリック 脆弱性です。 要約 このバグは winafl ファザーを使用して発見しました。このバグは、ms-tnef ファイル（eml ファイルの添付ファイル）の解析中に発生します。脆弱なメソッドは、vftable ポインタに範囲外のデータを読み取って使用します。そのため、攻撃者がこの脆弱性の悪用に成功すると、リモートコマンド実行がトリガーされます。 詳細 First chance...

Linux Distros Unpatched Vulnerability : CVE-2026-103680

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in tnef. A heap-based buffer overflow can occur in the findfreenumber function when generating numbered backup suffixes for duplicate filenames...

Linux Distros Unpatched Vulnerability : CVE-2026-103679

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in tnef. A remote attacker could exploit this vulnerability by providing a specially crafted Transport Neutral Encapsulation Format TNEF file...

Linux Distros Unpatched Vulnerability : CVE-2026-103678

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format RTF data...

CVE-2026-25512-PoC-Group-Office-Authenticated-RCE

CVE-2026-25512 PoC – Group-Office 認証済みRCE（TNEFハンドラ経由） 著者: Mohammed Idrees Banyamer ハンドル: @banyamersecurity GitHub: mbanyamer 日付: 2026年2月4日 エクスプロイトタイトル Group-Office Intermesh 26.0.4 – TNEF添付ファイルハンドラ経由の認証済みRCE CVE CVE-2026-25512 CWE CWE-78（OSコマンドインジェクション） ベンダー Intermesh / Group-Office 影響を受けるバージョン...

CVE-2026-25512

CVE-2026-25512: TNEFハンドラにおけるコマンドインジェクションによるリモートコード実行 - Group-Office CVSS 4.0 ベクター : CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H 目次 概要 影響を受けるバージョン 技術的詳細 根本原因 ソースからシンクへの流れ 悪用方法 自動エクスプロイト 手動エクスプロイト 影響 タイムライン クレジット 参考文献 概要 Group-Office において、重大なリモートコード実行（RCE） の脆弱性が確認されました。エンドポイント...

DEBIAN-CVE-2026-103680

A flaw was found in tnef. A heap-based buffer overflow can occur in the findfreenumber function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral...

CVE-2026-103679

A flaw was found in tnef. A remote attacker could exploit this vulnerability by providing a specially crafted Transport Neutral Encapsulation Format TNEF file containing multiple message bodies. During extraction, improper memory management triggers a use-after-free and double-free condition,...

DEBIAN-CVE-2026-103679

A flaw was found in tnef. A remote attacker could exploit this vulnerability by providing a specially crafted Transport Neutral Encapsulation Format TNEF file containing multiple message bodies. During extraction, improper memory management triggers a use-after-free and double-free condition,...

DEBIAN-CVE-2026-103678

A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format RTF data. Because the application fails to properly validate input buffer boundaries before copying data in getrtfdatafrombuf, reading beyond the...

CVE-2026-103680

A flaw was found in tnef. A heap-based buffer overflow can occur in the findfreenumber function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral...

CVE-2026-103678

A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format RTF data. Because the application fails to properly validate input buffer boundaries before copying data in getrtfdatafrombuf, reading beyond the...

CVE-2026-103679

A flaw was found in tnef. A remote attacker could exploit this vulnerability by providing a specially crafted Transport Neutral Encapsulation Format TNEF file containing multiple message bodies. During extraction, improper memory management triggers a use-after-free and double-free condition,...

CVE-2026-103678

A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format RTF data. Because the application fails to properly validate input buffer boundaries before copying data in getrtfdatafrombuf, reading beyond the...

CVE-2026-103680

A flaw was found in tnef. A heap-based buffer overflow can occur in the findfreenumber function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral...

CVE-2026-103680

A heap-based buffer overflow vulnerability exists in the tnef component within the find_free_number() function. The flaw is triggered during the generation of numbered backup suffixes for duplicate filenames. If numbered backups are enabled and file overwriting is disabled, an attacker can provid...

CVE-2026-103680 Tnef: heap buffer overflow in find_free_number() via numbered-backup suffix generation

A flaw was found in tnef. A heap-based buffer overflow can occur in the findfreenumber function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral...

CVE-2026-103680 Tnef: heap buffer overflow in find_free_number() via numbered-backup suffix generation

A flaw was found in tnef. A heap-based buffer overflow can occur in the findfreenumber function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral...

EUVD-2026-90773

A flaw was found in tnef. A heap-based buffer overflow can occur in the findfreenumber function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral...