Bug 2544478 (CVE-2026-103680)

Summary: CVE-2026-103680 tnef: Heap buffer overflow in find_free_number() via numbered-backup suffix generation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in tnef. A heap-based buffer overflow can occur in the find_free_number() function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral Encapsulation Format (TNEF) file with an excessive number of colliding attachment filenames, causing the numeric counter to write past the allocated memory buffer. This issue may result in an application crash, leading to a Denial of Service (DoS), or potentially arbitrary code execution.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2544597    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-01 09:18:15 UTC 
A flaw was found in tnef. find_free_number() allocates a fixed-size buffer sized for a 5-digit numeric backup suffix, but formats the counter with an unbounded sprintf(). When the --number-backups option is enabled and overwrite is disabled, a crafted TNEF stream that forces roughly 100,000 colliding candidate filenames for a single extracted attachment causes the counter to require six digits, writing past the end of the allocated heap buffer. The issue requires a non-default command-line option and a large, specially crafted input to trigger.