Is CVE-2026-62641 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62641 being exploited in the wild.

How severe is CVE-2026-62641?

Medium severity, with a CVSS score of 4.3, published 14 July 2026.

Which products and versions are affected?

Roundcube Webmail before 1.6.17, 1.7.x before 1.7.2.

Is there a fix for CVE-2026-62641?

A patch was published on 2026-07-05: Security updates 1.6.17 and 1.7.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-62641 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-62641?

Check whether you run Roundcube Webmail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62641: Roundcube Webmail denial of service in TNEF decoder

CVE-2026-62641 · Severity: medium · CVSS 4.3 · Published 2026-07-14

Roundcube Webmail, a widely used open-source email client, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted email attachment that, when processed, causes the email service to become unresponsive or crash. This can disrupt email access for users and impact business communications until the service is restored.

Technologies: Roundcube Webmail. Vendors: Roundcube.

Quick answers

Is CVE-2026-62641 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62641 being exploited in the wild.
How severe is CVE-2026-62641?: Medium severity, with a CVSS score of 4.3, published 14 July 2026.
Which products and versions are affected?: Roundcube Webmail before 1.6.17, 1.7.x before 1.7.2.
Is there a fix for CVE-2026-62641?: A patch was published on 2026-07-05: Security updates 1.6.17 and 1.7.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62641 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-62641?: Check whether you run Roundcube Webmail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial-of-service vulnerability exists in Roundcube Webmail's TNEF (Transport Neutral Encapsulation Format) decoder, specifically within the rcube_tnef_decoder.php component. The flaw is categorized as CWE-770 (Allocation of Resources Without Limits or Throttling) and is triggered when the decoder encounters a crafted compressed-RTF size in a 'winmail.dat' attachment. An unauthenticated remote attacker can exploit this by sending a malicious email to a user; when the webmail client attempts to decode the attachment, it may lead to resource exhaustion or an infinite loop, rendering the service unavailable. The issue is resolved in versions 1.6.17 and 1.7.2.

Affected products

Roundcube Webmail before 1.6.17, 1.7.x before 1.7.2

Timeline

2026-07-05: patched: Security updates 1.6.17 and 1.7.2 released
2026-07-14: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.