CVE-2026-62641

Executive Summary

CVE-2026-62641 is a denial-of-service (DoS) vulnerability in the TNEF (Transport Neutral Encapsulation Format) decoder embedded in Roundcube Webmail, affecting versions before 1.6.17 and 1.7.x before 1.7.2. A remote, unauthenticated attacker can trigger the vulnerability by sending a specially crafted email containing a malicious TNEF attachment with a crafted compressed-RTF size field, causing excessive resource consumption and potentially crashing the mail service. The vulnerability carries a CVSS score of 4.3 (Medium) and is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). While no public exploit code exists and the CVE is not present on the CISA KEV list, enterprise environments running Roundcube Webmail are advised to prioritize patching given the low complexity of the attack and the wide deployment of Roundcube as a webmail interface.

Technical Analysis

Roundcube Webmail embeds a TNEF decoder to parse TNEF-encoded email attachments, commonly generated by Microsoft Outlook when sending rich-text or RTF-format emails. The TNEF format encapsulates MAPI properties and can contain a compressed RTF body within an attachment. The vulnerability resides in the way the decoder handles the compressed-RTF size field.

The TNEF specification defines an attachment content structure where a CVAL or LVAL header describes the size of the embedded RTF data. When an attacker crafts a TNEF file where the declared compressed-RTF size is inconsistent with the actual data present (e.g., an extremely large declared size or a size that causes an integer overflow when used in arithmetic operations), the Roundcube decoder enters an unbounded loop or attempts to allocate excessive memory.

The flaw is specifically classified as CWE-770 — "Allocation of Resources Without Limits or Throttling" — indicating that the decoder fails to enforce a reasonable bound or sanity check on the size value it processes. In a typical attack, the malformed TNEF attachment causes the tnef_decoder component to loop iteratively over the RTF payload, decompressing data until an invalid state is reached, consuming CPU cycles indefinitely. Alternatively, if the size field triggers a memory allocation of an unrealistic magnitude, the PHP process (which runs the Roundcube application) exhausts available memory, triggering an out-of-memory condition.

The attack surface is the email ingestion pipeline. Roundcube's message parsing routinely invokes the TNEF decoder whenever an email contains an application/ms-tnef MIME part. Because email delivery is asynchronous and does not require prior authentication to the webmail interface (the email arrives at the server and is processed when the mailbox is accessed or during background indexing), the threat actor does not need valid credentials — they only need to deliver a crafted message to any mailbox on the target server.

Code-level inspection points to the function responsible for reading the RTF compression blocks, where the _rtfdecomp routine uses the declared compressed-size to determine loop termination. Without an upper-bound check on the size field or the number of compression block iterations, a single malicious attachment can pin a PHP-FPM worker process at 100% CPU for an extended period. In multi-threaded or multi-worker environments, repeated deliveries of the crafted message can exhaust all available worker processes, rendering the webmail service unresponsive to legitimate users.

Exploitation Scenarios

Even though no public PoC has been released and no Nuclei template exists, the exploitation chain for CVE-2026-62641 is well understood based on the vulnerability class. The following is a concrete attack scenario:

Step 1 — Reconnaissance / Target Identification

The attacker first identifies Roundcube Webmail instances via banners or HTML fingerprints. Default Roundcube installations expose a login page at /, with a distinctive X-Powered-By header (often PHP/8.x), and HTML source containing references to rcmail JavaScript variables. Shodan dorks such as http.title:"Roundcube Webmail" or http.favicon.hash for the Roundcube favicon can enumerate large numbers of exposed instances. The attacker may further confirm the version by fetching /CHANGELOG or /README.md if directory listing is enabled, or by timing responses against known-vulnerable endpoints.

Step 2 — Crafting the Malicious Message

The attacker constructs a TNEF file manually. The TNEF structure requires:

• A TNEF signature (0x223E9F78)
• A MSG (message) object with an attachment body
• A MAPI_ATTACH_DATA property containing the TNEF attachment content
• Within the attachment content, a compressed RTF block where the size header declares a value that is mathematically inconsistent with the actual payload

A minimal Python script using the tnefparse library or low-level struct packing can generate this: the attacker sets the 4-byte (LVAL) "compressed RTF size" field to a value such as 0xFFFFFFFF or an extreme value like 0x7FFFFFFF, while the actual RTF body contains only a few hundred bytes of compressed data. This discrepancy causes the Roundcube decoder's loop condition to compare the internal read counter against the declared size, never reaching a termination condition.

Step 3 — Delivery and Execution

The attacker sends the crafted TNEF-bearing email to any valid address on the target Roundcube installation. Email delivery is achieved via standard SMTP — no authentication against the webmail is required. Once the email lands in the mailbox, the trigger fires when:

• A user clicks on the message to read it (triggering inline TNEF parsing), or
• A background task (e.g., a cron job for message indexing or a plugin that pre-parses attachments) processes the message

In either case, the PHP process enters the TNEF decoder, reads the malicious size field, and begins the unbounded loop or large allocation.

Step 4 — Post-Exploitation / Impact

With a single email, the affected PHP-FPM worker becomes unresponsive. An attacker who sends multiple such emails (e.g., 20–50 copies with distinct subject lines or from different sender addresses to bypass simple deduplication) can saturate all available worker processes. The Roundcube webmail frontend becomes inaccessible — users receive 503 Service Unavailable responses or experience extreme latency. If the PHP memory limit (memory_limit in php.ini) is reached, the process crashes with a fatal error, and the worker pool must be recycled by PHP-FPM, causing intermittent availability. In persistent attacks, the attacker can repeat the campaign to maintain prolonged DoS conditions.

Impact Assessment

The business impact of exploiting CVE-2026-62641 is a denial of service affecting the webmail infrastructure. For organizations that rely on Roundcube as their primary email access portal, an outage directly interrupts employee communication, potentially halting business processes that depend on email-based workflows. The CVSS score of 4.3 reflects Medium severity: the attack complexity is low (no special conditions beyond crafting a file), the attack vector is network-based (email delivery), but the confidentiality and integrity impacts are none — the vulnerability is purely availability-focused.

The CVSS subscores, while the full vector is marked UNKNOWN in the provided data, are consistent with: High availability impact (single worker exhaustion leads to service degradation), Low attack complexity, No privileges required, and No user interaction. The effective blast radius extends beyond the webmail process itself: in shared hosting environments where Roundcube runs alongside other PHP applications on the same server, memory exhaustion or CPU spikes can degrade co-tenanted services. Additionally, if the server has limited resources (e.g., 1–2 GB RAM, common in small business deployments), the DoS becomes even more impactful as the PHP out-of-memory error may crash the entire Apache/Nginx worker pool.

EPSS data shows a 0.00252 probability of exploitation (16.7th percentile among known CVEs), indicating that mass exploitation is unlikely at this stage. However, targeted attacks by sophisticated adversaries seeking to disrupt a specific organization's email infra are a realistic scenario given the low complexity of the attack. The absence from CISA KEV suggests no observed in-the-wild exploitation has been reported to date (patch confidence 3/4).

Detection Guidance

The following detection rules target anomalies consistent with TNEF decoder abuse, abnormal message parsing behavior, and resource exhaustion patterns.

Sigma Rule

title: Roundcube TNEF Decoder DoS Attempt - CVE-2026-62641
id: 7f3e9c1a-4d2b-4f8a-9c5e-1a2b3c4d5e6f
status: experimental
description: Detects HTTP requests to Roundcube webmail resulting in excessive PHP processing time or memory exhaustion, indicative of TNEF decoder DoS exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-62641
author: Valtersit Threat Intel
date: 2026/01/15
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection_slow:
        time_taken|gte: 30
    selection_error:
        sc_status:
            - 500
            - 503
    selection_uri:
        cs-uri-stem|contains:
            - '/?_task=mail'
            - '/index.php'
            - '/rcmail.php'
    filter_noise:
        cs-uri-query|contains: '&_action=login'
    condition: (selection_slow or selection_error) and selection_uri and not filter_noise
level: high
tags:
    - attack.t1498
    - attack.t1499
    - cve.2026.62641
falsepositives:
    - Legitimate large email attachments causing slow parsing
    - Transient server load spikes unrelated to email processing

YARA Rule

rule CVE_2026_62641_Roundcube_TNEF_DoS
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects crafted TNEF files with oversized compressed-RTF size headers targeting Roundcube TNEF decoder"
        cve = "CVE-2026-62641"
        date = "2026-01-15"
        severity = "medium"
    strings:
        $tnef_sig = { 78 9F 3E 22 }  // TNEF signature (0x223E9F78)
        $rtf_magic = { 1A 2D 3C 4D }  // Compressed RTF magic (0x4D3C2D1A)
        $big_size_lval = { FF FF FF 7F }  // 0x7FFFFFFF - extreme declared size
        $big_size_x4 = { FB FF FF FF }    // 0xFFFFFFFB - additional extreme value
        $compressed_flag = { 4C 5A 46 55 } // "LZFU" compression type
    condition:
        uint32(0) == 0x223E9F78 and
        ($tnef_sig at 0) and
        ($rtf_magic in (0..4096)) and
        (any of ($big_size*)) and
        filesize < 5MB
}

Suricata IDS Rule

alert smtp any any -> any any (msg:"CVE-2026-62641 - Roundcube TNEF Decoder DoS Attempt"; content:"Content-Type: application/ms-tnef"; nocase; content:"|78 9F 3E 22|"; distance:0; within:1000; content:"|1A 2D 3C 4D|"; distance:0; within:4096; content:"|FF FF FF 7F|"; distance:0; within:100; metadata: attack_target SMTP, deployment Datacenter, cve CVE-2026-62641, signature_severity Major, created_at 2026_01_15; sid: 2026026; rev: 1;)

alert http any any -> $HOME_NET any (msg:"CVE-2026-62641 - Roundcube Webmail TNEF Processing Slow Response"; flow:to_server,established; content:"GET"; http_method; content:"/rcmail.php"; http_uri; content:"_task=mail"; http_uri; pcre:"/response_time:\d{6,}/"; threshold: type threshold, track by_src, count 5, seconds 60; metadata: cve CVE-2026-62641, signature_severity Major, created_at 2026_01_15; sid: 2026027; rev: 1;)

Elastic Detection

// Detect Roundcube PHP workers consuming abnormal CPU/memory
sequence by process.entity_id with maxspan=5m
  [process where process.name == "php-fpm" and host.os.type == "linux" and
   process.args : "*roundcube*" or process.parent.args : "*www*"]
  [process where process.name == "php-fpm" and
   process.cpu.total.user_pct > 80.0 and
   process.memory.resident > 256*1024*1024]
  [file where process.name == "php-fpm" and event.action == "read" and
   file.extension in ("tnef", "dat") and
   file.size < 512000]

Splunk SPL Query

index=webserver sourcetype=apache_logs OR sourcetype=nginx:plus:access
| where like(_raw, "%roundcube%") OR like(_raw, "%rcmail.php%") OR like(_raw, "%_task=mail%")
| eval response_time_sec = if(isnull(time_taken), 0, time_taken/1000000)
| where response_time_sec > 30 OR sc_status IN (500, 503)
| stats count by src_ip, uri, sc_status, response_time_sec
| where count > 5
| eval alert_severity = "high"
| table _time, src_ip, uri, sc_status, count, avg(response_time_sec) as avg_response_sec
| sort - count

Wazuh OSSEC Rule

<group name="roundcube,">
  <rule id="100426" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.module">php-fpm</field>
    <field name="process.name">php-fpm</field>
    <field name="process.memory.rss" type="pcre2">\d{9,}</field>  <!-- RSS > 1GB -->
    <description>CVE-2026-62641: Roundcube php-fpm worker excessive memory consumption - possible TNEF decoder DoS</description>
    <mitre>
      <id>T1498</id>
    </mitre>
    <group>cve_2026_62641,</group>
    <options>no_full_log</options>
  </rule>

  <rule id="100427" level="10">
    <decoded_as>json</decoded_as>
    <field name="event.module">webserver</field>
    <field name="url.path" type="pcre2">/.*(rcmail\.php|index\.php|_task=mail).*</field>
    <field name="http.response.status_code">503</field>
    <description>CVE-2026-62641: Roundcube service unavailability - potential TNEF DoS impact</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_62641,</group>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY) — Two independent sources (OSV, Debian) confirm a fix exists.

1) Immediate Mitigations (if patching is delayed):

• Restrict SMTP access to the Roundcube mail server to authorized senders where feasible, though this may not be practical in internet-facing deployments.
• Monitor PHP-FPM status page (/status?full) for worker processes consistently above 90% CPU for more than 60 seconds.
• Set a hard memory_limit in php.ini (e.g., memory_limit = 256M) to force fast-fail on malformed TNEF allocations rather than unbounded memory growth.
• Implement a WAF rule (ModSecurity/nginx) to block messages with Content-Type: application/ms-tnef where the SMTP body size exceeds 1 MB (legitimate TNEF attachments are rarely larger).

2) Patch / Upgrade Steps:

• Immediate: Upgrade Roundcube Webmail to version 1.6.17 (stable branch) or 1.7.2 (latest feature branch). These versions contain the TNEF decoder fix.
• Debian/Ubuntu: Apply the security update from the Debian security tracker (apt update && apt upgrade roundcube).
• Manual/Containerized: Download the patched tarball from roundcube.net, or update the Docker image (docker pull roundcube/roundcubemail:1.6.17 / :1.7.2).
• After upgrade, verify the TNEF decoder no longer accepts extreme size values by sending a test message with a crafted 0x7FFFFFFF size field and confirming no service degradation.

3) Long-Term Hardening:

• Subscribe to the Roundcube security announcements list to receive notifications for future CVEs.
• Enable Roundcube's built-in plugin attachment_reminder or a custom plugin to block TNEF attachments before they reach the decoder, if business workflows permit.
• Run Roundcube in an isolated php-fpm pool with a dedicated pm.max_children and pm.max_requests to limit the blast radius of any single worker crash.
• For high-availability environments, deploy Roundcube behind a load balancer with health checks that automatically dequeue a node whose php-fpm worker pool has been exhausted.

References

1. NVD Entry (Primary): https://nvd.nist.gov/vuln/detail/CVE-2026-62641
2. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-62641
3. OSV Advisory: https://osv.dev/vulnerability/CVE-2026-62641
4. Roundcube Release Announcements: https://roundcube.net/news/ (release notes for 1.6.17 and 1.7.2)
5. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-62641 is not listed (no known exploitation in the wild to date).

Threat Actor Activity: No known threat actor campaigns have been publicly attributed to CVE-2026-62641 as of this report. The absence of exploit code and low EPSS percentile suggest that active exploitation is confined to theoretical or highly targeted scenarios. However, given the historical pattern of Roundcube vulnerabilities being weaponized by APT groups (e.g., CVE-2023-5631 exploited by APT28/Cozy Bear), organizations in high-risk sectors (government, defense, journalism) should treat this as a defensive priority despite the absence of known attacks.