CVE-2026-111145: ytnef 0 through 2.1.2

Affected technology

ytnef · 0 through 2.1.2
Yeraze

Description’s affected range: through 2.1.2

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · Passive user interaction

What an attacker can do

Attackers can supply a crafted winmail.dat TNEF attachment with a malicious PT_BINARY MAPI property to crash ytnefprint or libytnef callers and leak adjacent heap memory. Vendor/CNA’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality impact as low; integrity impact as none; availability impact as high.