Executive brief
Roundcube Webmail, a widely used open-source email client, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted email attachment that, when processed, causes the email service to become unresponsive or crash. This can disrupt email access for users and impact business communications until the service is restored.
Technical details
A denial-of-service vulnerability exists in Roundcube Webmail's TNEF (Transport Neutral Encapsulation Format) decoder, specifically within the rcube_tnef_decoder.php component. The flaw is categorized as CWE-770 (Allocation of Resources Without Limits or Throttling) and is triggered when the decoder encounters a crafted compressed-RTF size in a 'winmail.dat' attachment. An unauthenticated remote attacker can exploit this by sending a malicious email to a user; when the webmail client attempts to decode the attachment, it may lead to resource exhaustion or an infinite loop, rendering the service unavailable. The issue is resolved in versions 1.6.17 and 1.7.2.
Affected products
- Roundcube Webmail before 1.6.17, 1.7.x before 1.7.2
Timeline
- 2026-07-05: patched: Security updates 1.6.17 and 1.7.2 released
- 2026-07-14: disclosed: CVE published to NVD
References
- https://github.com/roundcube/roundcubemail/commit/6d1004fd3764a9606c53130b322c0f295c38be64
- https://github.com/roundcube/roundcubemail/commit/bf253c72d4293c93fda511b8464fe9cb34b522c1
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.17
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.2
- https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2