6.5

CVE-2026-62642

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Roundcube ≫ Webmail Version >= 1.6.0 < 1.6.17
Roundcube ≫ Webmail Version >= 1.7.0 < 1.7.2
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.28% 0.198
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
MITRE 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

https://github.com/roundcube/roundcubemail/releases/tag/1.6.17
Release Notes
https://github.com/roundcube/roundcubemail/releases/tag/1.7.2
Release Notes
https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2
Vendor Advisory
https://github.com/roundcube/roundcubemail/commit/132ac8dd5a55c8466be12de1daf84355697ffa89
Patch
https://github.com/roundcube/roundcubemail/commit/877269c79359d959a94f13c9070cab0f3389c193
Patch
https://github.com/roundcube/roundcubemail/commit/a007321346380136b3de2bd75b486b04f63c0d38
Patch
https://github.com/roundcube/roundcubemail/commit/fb952956c6eaf29e963f1a718d028d66e7957ce0
Patch