Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in tnef. When a TNEF stream contains more than one MAPI RTF or HTML body value, get_body_files() allocates a single filename buffer and a single MIME-type buffer and assigns the same pointers to every generated output file, instead of a separate copy per file. Each of these files is later freed independently, producing a use-after-free followed by a double-free on the second and subsequent files. The issue was confirmed under AddressSanitizer and crashes the process when extracting a crafted TNEF stream with multiple body values; no code-execution primitive has been demonstrated.