# CVE-2026-62641: Roundcube Webmail denial of service in TNEF decoder

Source: https://junglewise.ai/threats/cve-2026-62641-roundcube-webmail-denial-of-service-in-tnef-decoder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-62641 · Severity: medium · CVSS 4.3 · Published 2026-07-14

Roundcube Webmail, a widely used open-source email client, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted email attachment that, when processed, causes the email service to become unresponsive or crash. This can disrupt email access for users and impact business communications until the service is restored.

Technologies: [Roundcube Webmail](https://junglewise.ai/threats/technologies/webmail). Vendors: [Roundcube](https://junglewise.ai/threats/vendors/roundcube).

## Quick answers

**Is CVE-2026-62641 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62641 being exploited in the wild.

**How severe is CVE-2026-62641?** Medium severity, with a CVSS score of 4.3, published 14 July 2026.

**Which products and versions are affected?** Roundcube Webmail before 1.6.17, 1.7.x before 1.7.2.

**Is there a fix for CVE-2026-62641?** A patch was published on 2026-07-05: Security updates 1.6.17 and 1.7.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62641 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-62641?** Check whether you run Roundcube Webmail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial-of-service vulnerability exists in Roundcube Webmail's TNEF (Transport Neutral Encapsulation Format) decoder, specifically within the rcube_tnef_decoder.php component. The flaw is categorized as CWE-770 (Allocation of Resources Without Limits or Throttling) and is triggered when the decoder encounters a crafted compressed-RTF size in a 'winmail.dat' attachment. An unauthenticated remote attacker can exploit this by sending a malicious email to a user; when the webmail client attempts to decode the attachment, it may lead to resource exhaustion or an infinite loop, rendering the service unavailable. The issue is resolved in versions 1.6.17 and 1.7.2.

## Affected products

- Roundcube Webmail before 1.6.17, 1.7.x before 1.7.2

## Timeline

- 2026-07-05: patched: Security updates 1.6.17 and 1.7.2 released
- 2026-07-14: disclosed: CVE published to NVD

## References

- [https://github.com/roundcube/roundcubemail/commit/6d1004fd3764a9606c53130b322c0f295c38be64](https://github.com/roundcube/roundcubemail/commit/6d1004fd3764a9606c53130b322c0f295c38be64)
- [https://github.com/roundcube/roundcubemail/commit/bf253c72d4293c93fda511b8464fe9cb34b522c1](https://github.com/roundcube/roundcubemail/commit/bf253c72d4293c93fda511b8464fe9cb34b522c1)
- [https://github.com/roundcube/roundcubemail/releases/tag/1.6.17](https://github.com/roundcube/roundcubemail/releases/tag/1.6.17)
- [https://github.com/roundcube/roundcubemail/releases/tag/1.7.2](https://github.com/roundcube/roundcubemail/releases/tag/1.7.2)
- [https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2](https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2)

## Related threats

- [Roundcube Webmail improper authentication in multi-host installations](https://junglewise.ai/threats/cve-2026-114732-roundcube-webmail-before-1-6-20-and-1-7-x-before-1-7-5-is)
- [Roundcube Webmail uncontrolled resource consumption in CSS proxy](https://junglewise.ai/threats/cve-2026-114731-roundcube-webmail-before-1-6-20-and-1-7-x-before-1-7-5-is)
- [Roundcube Webmail server-side request forgery filter bypass](https://junglewise.ai/threats/cve-2026-114730-roundcube-webmail-1-6-14-before-1-6-20-and-1-7-0-before-1-7-5-is)
- [Roundcube Webmail content blocking bypass via SVG SMIL](https://junglewise.ai/threats/cve-2026-114729-roundcube-webmail-before-1-6-20-and-1-7-x-before-1-7-5-is)
- [Roundcube Webmail remote content blocking bypass in CSS FuncIRI handling](https://junglewise.ai/threats/cve-2026-114728-roundcube-webmail-before-1-6-20-and-1-7-x-before-1-7-5-is)