CVE-2026-103679: 
NixOS vulnerability analysis and mitigation

CVE-2026-103679 is a use-after-free and double-free vulnerability in the open-source tnef utility (versions up to and including 1.4.18), a tool for unpacking MIME attachments of type application/ms-tnef. A remote attacker can exploit this flaw by supplying a specially crafted TNEF file containing multiple message bodies, triggering improper memory management in the get_body_files() function and causing a Denial of Service (DoS) via application crash. The vulnerability was disclosed on October 1, 2026, and was reported by Julien Ahrens of RCE Security GmbH. It carries a CVSS v3.1 base score of 6.5 (Medium) (Red Hat CVE, Github Advisory).

The root cause is classified as CWE-416 (Use After Free). In the get_body_files() function, when a TNEF stream contains more than one MAPI RTF or HTML body value, the code allocates a single filename buffer and a single MIME-type buffer and assigns the same pointers to every generated output file rather than allocating separate copies per file. Each of these files is subsequently freed independently, producing a use-after-free on the second reference and a double-free on subsequent ones. The issue was confirmed under AddressSanitizer and reliably crashes the process when extracting a crafted TNEF stream with multiple body values; no code-execution primitive has been demonstrated (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation results in an application crash, causing a Denial of Service for any system or pipeline that processes TNEF attachments using the affected tnef utility. Because user interaction is required (a victim or automated process must open or extract the malicious TNEF file), the practical impact is limited to availability — there is no demonstrated confidentiality or integrity impact. Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product, limiting the scope of affected deployments to direct users of the upstream tnef tool (Red Hat CVE, Github Advisory).

As of the disclosure date, there are no known public proof-of-concept exploits, no evidence of in-the-wild exploitation, and no threat actor attribution (Red Hat Bugzilla). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a victim or automated process must attempt to extract a maliciously crafted TNEF file — and no code-execution primitive has been demonstrated, further reducing the risk profile.

1. Craft a malicious TNEF file: Create a TNEF stream that contains more than one MAPI RTF or HTML body value (e.g., multiple attMsgBody attributes). This can be done by manually constructing or modifying a TNEF binary to include duplicate body entries.
2. Deliver the file to the target: Send the crafted TNEF file as an email attachment or otherwise make it available to a system or user that processes TNEF attachments using the vulnerable tnef utility (versions ≤ 1.4.18).
3. Trigger extraction: The victim or an automated mail processing pipeline invokes tnef to extract the attachment (e.g., tnef malicious.tnef).
4. Trigger use-after-free/double-free: During extraction, get_body_files() allocates a single filename and MIME-type buffer shared across all body entries. When each file is freed independently, the second and subsequent frees operate on already-freed memory, triggering a use-after-free and double-free condition.
5. Achieve DoS: The process crashes due to heap corruption, resulting in a Denial of Service (Red Hat Bugzilla, Red Hat CVE).

• File System: Presence of unexpected or malformed .tnef or winmail.dat files with multiple embedded body sections in mail spool directories or attachment staging areas.
• Logs: Crash reports or core dumps from the tnef process (e.g., entries in /var/log/syslog, /var/log/mail.log, or application logs indicating segmentation faults or heap corruption errors from tnef).
• Process: Unexpected termination of the tnef process with signals such as SIGABRT or SIGSEGV, particularly when processing email attachments of type application/ms-tnef.
• AddressSanitizer output: If tnef is compiled with ASan, logs will show heap-use-after-free or double-free errors referencing get_body_files() (Red Hat Bugzilla).

Users should upgrade tnef to a version beyond 1.4.18 once a patched release is published by the upstream project at github.com/verdammelt/tnef. As a workaround, administrators can restrict or disable automated processing of application/ms-tnef attachments in mail pipelines until a fix is available. Red Hat has confirmed that no currently supported Red Hat product is affected, so no Red Hat-specific patch action is required (Red Hat CVE, Github Advisory).

Red Hat Product Security issued a statement confirming that this vulnerability does not affect any currently supported Red Hat product, while acknowledging the flaw in the upstream tnef project. The vulnerability was reported by Julien Ahrens of RCE Security GmbH, a recognized security research firm. No significant broader media coverage or notable social media discussion has been observed as of the disclosure date (Red Hat CVE).