Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111146— ytnef through 2.1.2 Heap Out-of-Bounds Read via MAPIPrint in lib/ytnef.c

Quick assessment

Affected
Yeraze ytnef
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ytnef 2.1.2 及之前版本在 MAPIPrint() 函数中存在一个堆缓冲区越界读取漏洞。攻击者可以通过提供压缩的 RTF 属性，导致读取超出堆分配区域的内存。攻击者可以投递一个构造的 winmail.dat 文件，其解压缩后的 RTF 内容缺少空字符（NUL）终止符，从而引发 printf 函数越界读取，导致 ytnefprint 崩溃，并泄露相邻的堆内存数据。

CVSS 6.1 · Medium EPSS 0.13% · P2

Possible ATT&CK Techniques 1 AI

T1210 · Exploitation of Remote Services

Affected Version Matrix 1

VendorProduct Version RangeStatus
Yeraze ytnef ≤ 2.1.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-111146

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ytnef through 2.1.2 Heap Out-of-Bounds Read via MAPIPrint in lib/ytnef.c
Source: CVE Program / CVE List V5
Vulnerability Description
ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint() that allows attackers to read past heap allocations by supplying compressed RTF properties. Attackers can deliver a crafted winmail.dat whose decompressed RTF lacks a NUL terminator, causing printf to over-read, crashing ytnefprint and leaking adjacent heap bytes.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Yeraze ytnef 0 ~ 2.1.2 -

II. Public POCs for CVE-2026-111146

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111146

请登录查看更多情报信息。

Proof of Concept for CVE-2026-111146 (1)

Other References for CVE-2026-111146 (2)

IV. Related Vulnerabilities

Same product: ytnef
Same vendor: Yeraze
Same weakness: CWE-125

V. Comments for CVE-2026-111146

No comments yet

Leave a comment