Heap Out-of-Bounds Read in ytnef Affects Users of Yeraze Software
CVE-2026-111145
6.9MEDIUM
What is CVE-2026-111145?
The ytnef software, versions up to 2.1.2, is susceptible to a heap out-of-bounds read vulnerability that occurs in the DecompressRTF() function within lib/ytnef.c. This issue arises from a failure to validate the uncompressedSize parameter for uncompressed RTF streams, which can be exploited when an attacker supplies a crafted winmail.dat TNEF attachment containing a malicious PT_BINARY MAPI property. This manipulation can lead to crashes of ytnefprint and other libytnef callers, as well as the unintended disclosure of adjacent heap memory, posing a threat to system integrity and data protection.
Affected Version(s)
ytnef 0 <= 2.1.2
References
CVSS V4
Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved
Credit
DrWhax
HaiND from the Post and Telecommunication Institute of Technology