A flaw was found in tnef. find_free_number() allocates a fixed-size buffer sized for a 5-digit numeric backup suffix, but formats the counter with an unbounded sprintf(). When the --number-backups option is enabled and overwrite is disabled, a crafted TNEF stream that forces roughly 100,000 colliding candidate filenames for a single extracted attachment causes the counter to require six digits, writing past the end of the allocated heap buffer. The issue requires a non-default command-line option and a large, specially crafted input to trigger.