CVE-2026-62642

Executive Summary

CVE-2026-62642 is a denial-of-service (DoS) vulnerability in Roundcube Webmail's Transport Neutral Encapsulation Format (TNEF) decoder, affecting versions prior to 1.6.17 and 1.7.x prior to 1.7.2. A crafted email containing a malicious TNEF attachment can trigger an infinite loop in the decoder, causing the mail server process to hang or exhaust CPU resources. This affects all Roundcube deployments that allow TNEF attachment processing, which is enabled by default for Outlook compatibility. The vulnerability has a CVSS score of 4.3 (Medium severity) and has been confirmed patched by two independent sources (OSV and Debian).

Technical Analysis

The vulnerability resides in Roundcube's TNEF decoder component, which parses Transport Neutral Encapsulation Format attachments — a proprietary binary format used by Microsoft Outlook to encapsulate rich content such as embedded OLE objects, RTF-formatted message bodies, and metadata. The decoder is implemented to iteratively process TNEF attribute blocks, each flagged with a 4-byte type identifier and a length field.

The flaw is an infinite loop condition, classified under CWE-835 (Loop with Unreachable Exit Condition). When the decoder encounters a TNEF attribute whose length field is malformed (e.g., a value of 0 or a value that does not advance the buffer pointer), the loop that iterates over attributes never reaches its termination condition. Specifically, if the parser reads a zero-length attribute or an attribute length that causes the cursor position to remain static, the while loop continues indefinitely.

The attack surface is the email parsing pipeline. An attacker sends a specially crafted email with a TNEF (normally a winmail.dat or winmail.dat-type attachment) payload. Upon user opening the email (or in some configurations, upon the mail client fetching and indexing the message), Roundcube's rcube_message_part handler invokes the TNEF decoder. The decoder enters the infinite loop, spinning at 100% CPU usage per affected worker thread. Since Roundcube typically spawns PHP-FPM workers or Apache prefork children to handle sessions, a single malicious email can pin one worker thread indefinitely. In a shared hosting environment or a deployment with limited worker pools, multiple emails can exhaust all workers, rendering the webmail interface unresponsive.

The affected code path is in program/lib/Roundcube/rtf.php or the roundcube/tnef_decoder library (depending on the packaging), specifically in the tnef_get_attribute loop. The vulnerable loop iterates over the TNEF data buffer using a pointer variable; the malformed length field prevents pointer advancement, creating the infinite loop.

Exploitation Scenarios

The attack chain for CVE-2026-62642 is straightforward and requires no authentication beyond a valid email account (or, in some configurations, an account on the same mail server that Roundcube connects to via IMAP):

1. Reconnaissance/Identification: The attacker identifies a Roundcube Webmail instance via HTTP fingerprinting. Shodan dorks such as http.title:"Roundcube" or http.component:"Roundcube" reveal exposed instances. The attacker may also validate the version by requesting /CHANGELOG or /README.md if accessible, or by observing the X-Powered-By header or the release indicator in the login page's HTML source.

2. Weaponization (malformed TNEF payload): The attacker constructs a minimal TNEF file. A TNEF file starts with the signature 0x223E9F78; the attacker crafts an attribute block with a malicious length field. For example, an attribute block header with a type of 0x0001 (attOwner) and a length of 0x00000000 (zero bytes) will cause the decoder's loop to not advance the buffer pointer. The attacker packages this as winmail.dat and attaches it to a new email. The email can be sent to the victim from any mail account on the same mail server (or from an external server if the Roundcube instance is configured with open relay handling — typically it connects to a downstream IMAP server).

3. Trigger/Exploitation: The victim logs into Roundcube and opens the email. Roundcube's message parsing engine detects the winmail.dat attachment with MIME type application/ms-tnef and invokes the TNEF decoder. The decoder enters the infinite loop. If the Roundcube deployment uses PHP-FPM, the worker process is pinned at 100% CPU. If the email client is configured to auto-preview attachments (some deployments with the preview plugin or columns layout settings), the loop may be triggered merely by listing the mailbox, amplifying the impact.

4. Post-Exploitation Impact: The attacker sends the same email to multiple mailboxes in the domain. Each opened email pins a PHP-FPM worker or Apache child process. With a typical worker pool of 10–20 processes, 10–20 emails exhaust all workers. Legitimate users experience timeouts and 503 errors; the webmail service becomes unavailable. In shared environments, the CPU spike may trigger hosting provider alerts or cause other tenants on the same server to degrade. Since the loop is indefinite, the worker processes must be manually killed or the PHP-FPM pool restarted to recover.

Impact Assessment

CVSS score of 4.3 (Medium) reflects a low attack complexity but limited security impact beyond availability. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L — network attack vector, low complexity, no privileges, but requires user interaction (the victim must open the email), and only impacts availability. However, the practical severity in enterprise deployments is higher than the raw score suggests. For organizations that rely on Roundcube as their primary email interface (common in privacy-focused or self-hosted environments), a successful exploit results in complete webmail outage requiring manual intervention to terminate hung PHP processes. In high-volume or multi-tenant deployments, the CPU exhaustion can cascade to other services hosted on the same infrastructure. The EPSS score of 0.00277 indicates a low probability of exploitation in the wild, and CISA has not added this to the KEV catalog, but this does not diminish the need for patching given the trivial attack mechanics.

Detection Guidance

Sigma Rule

title: Roundcube TNEF Decoder Infinite Loop Exploit Attempt
id: 9eef6b6d-7f4a-4a8b-8f2e-9d1a3c5b7e0f
status: experimental
description: Detects email messages delivered to Roundcube with malformed TNEF attachments (zero-length or negative-length attribute blocks) that trigger CVE-2026-62642.
tags:
    - attack.t1499
    - attack.impact
    - cve.2026.62642
logsource:
    product: mail_server
    service: mail_logs
detection:
    selection_attach:
        attachment_name: 'winmail.dat'
        attachment_mime: 'application/ms-tnef'
    selection_size:
        attachment_size: '< 100'
    filter_known_good:
        attachment_md5|startswith: 
            - '0000'
            - 'ffff'
    condition: selection_attach and selection_size and not filter_known_good
level: medium
fields:
    - recipient
    - sender
    - subject
    - attachment_name
    - attachment_size
falsepositives:
    - Legitimate small winmail.dat files from Outlook users (rare, typically > 500 bytes)

YARA Rule

rule CVE_2026_62642_Roundcube_TNEF_InfiniteLoop
{
    meta:
        author = "ValterSIT Threat Intel"
        description = "Detects malformed TNEF files targeting Roundcube decoder infinite loop (CVE-2026-62642)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-62642"
        date = "2026-06-15"
        cve = "CVE-2026-62642"
        severity = "medium"
    strings:
        $tnef_sig = { 22 3E 9F 78 }  // TNEF signature 0x223E9F78
        $zero_len = { 00 00 00 00 }  // zero-length attribute block
        $repeat_att = { 01 00 00 00 00 00 00 00 }  // attOwner with zero data length repeated pattern
        $class_header = { 01 00 00 00 00 }  // attribute class + attributes present flag
    condition:
        $tnef_sig at 0 and 
        ( $zero_len or $repeat_att ) and 
        filesize < 200
}

Suricata IDS Rule

alert smtp any any -> any any (msg:"CVE-2026-62642 Roundcube TNEF infinite loop attempt"; flow:established,to_server; content:"winmail.dat"; nocase; content:"application/ms-tnef"; nocase; content:"|22 3E 9F 78|"; depth:4; offset:rawbytes_from_mime; content:"|00 00 00 00|"; within:8; classtype:attempted-dos; sid:2026062642; rev:1; reference:cve,2026-62642; metadata:created_at 2026_06_15, updated_at 2026_06_15;)

Note: This rule triggers on SMTP traffic carrying the malicious attachment. For IMAP-based delivery, deploy the rule on the IMAP server interface with appropriate offset tuning.

Elastic Detection

/* EQL query - Detect Roundcube PHP workers running at high CPU after TNEF email delivery */
sequence by host.name, process.name with maxspan=10m
  [ network where dns.question.name == "mailserver.example.com" or
    network.protocol == "http" and network.direction == "egress" ]
  [ process where process.name == "php-fpm" or process.name == "apache2" or process.name == "httpd"
    and process.cpu.total.user > 3600  /* ~1 hour of cumulative CPU in a 10-min window suggests a loop */
    and process.command_line contains "roundcube" ]
  [ file where file.name == "winmail.dat" and file.size < 200 ]

Splunk SPL Query

index=main sourcetype=php_combined OR sourcetype=apache_access
| where match(_raw, "roundcube")
| eval cpu_user=strftime(_time, "%s")
| stats sum(bytes) as total_bytes, values(uri) as uris, max(process_cpu) as max_cpu by src_ip, user
| where max_cpu > 90
| table _time, src_ip, user, total_bytes, uris, max_cpu
| append [search index=mail_logs sourcetype=maillog
    | where attachment="winmail.dat" and attachment_size < 200
    | table _time, sender, recipient, subject, attachment]
| sort - _time

Wazuh OSSEC Rule

<group name="roundcube,">
  <rule id="100602" level="10">
    <decoded as="json"/>
    <field name="event_type">^smtp_message$</field>
    <field name="attachment_name">^winmail\.dat$</field>
    <field name="attachment_mime">^application/ms-tnef$</field>
    <field name="attachment_size">^\d{1,2}$</field>
    <description>Roundcube CVE-2026-62642: TNEF attachment with suspicious size (potential infinite-loop trigger)</description>
    <group>cve-2026-62642,roundcube,malware,</group>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
  <rule id="100603" level="12" frequency="10" timeframe="60">
    <if_matched_sid>100602</if_matched_sid>
    <description>Roundcube CVE-2026-62642: Multiple suspicious TNEF emails detected (mass DoS campaign)</description>
    <group>cve-2026-62642,roundcube,dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY — 2 independent sources confirm fix).

1. Immediate mitigations (temporary):

   • Restrict incoming TNEF attachment handling: in Roundcube configuration (config/config.inc.php), set $config['mime_param_folding'] = 0; and block the application/ms-tnef MIME type via $config['blocked_mime_types'] = ['application/ms-tnef'];. This prevents the decoder from being invoked on new emails.
   • Apply a PHP timeout: set max_execution_time = 30 in php.ini for the Roundcube pool. While this does not prevent the loop, it allows PHP-FPM to terminate the worker after 30 seconds, mitigating resource exhaustion.
   • Implement an upstream mail gateway filter (e.g., SpamAssassin or Rspamd) to quarantine winmail.dat attachments under 200 bytes.

2. Patch/upgrade steps:

   • Upgrade to Roundcube 1.6.17 or 1.7.2 (or later). Both branches are patched. Debian has published fixed packages (check debian-security-support for your release — e.g., Debian 12 bookworm receives 1.6.17+; Debian 11 bullseye may receive a backport or require migration).
     • Debian/Ubuntu: apt update && apt upgrade roundcube
     • RPM-based (EPEL, etc.): dnf update roundcubemail
     • Manual installs: download the tarball from https://roundcube.net/download/, verify the GPG signature, and replace the source directory.
   • After upgrading, verify the installed version: grep 'RCMAIL_VERSION' /usr/share/roundcube/program/include/iniset.php or check ?/? on the about page.

3. Long-term hardening:

   • Disable TNEF decoding entirely if not strictly required for user workflows ('mime_param_folding' => 0 and remove any tnef_decoder plugin/extension).
   • Restrict Roundcube access via VPN or IP allow-listing to reduce the attack surface for unauthenticated external actors.
   • Implement per-worker memory/CPU limits (e.g., php_admin_value[memory_limit] = 128M) and use systemd resource control (CPUQuota, TasksMax) for PHP-FPM.
   • Monitor for abnormal CPU usage spikes in Roundcube worker processes; set up alerting on process-level CPU > 80% sustained for 5 minutes.
   • Subscribe to the Roundcube announce mailing list (https://lists.roundcube.net/mailman3/postorius/lists/announce.lists.roundcube.net/) for future security advisories.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-62642
2. Roundcube Security Advisory: https://roundcube.net/news/2026/06/10/security-update-1.6.17-and-1.7.2/ (official release notes confirming the TNEF decoder fix)
3. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-62642 (confirms patched versions in Debian releases)
4. OSV.dev Vulnerability Entry: https://osv.dev/vulnerability/CVE-2026-62642 (references the vulnerable-to-fixed commit ranges in OSV packages)
5. CWE-835 Reference: https://cwe.mitre.org/data/definitions/835.html

Threat actor campaign evidence: No active campaigns or exploit-in-the-wild activity have been reported for CVE-2026-62642 as of this report date. The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.00277 (19.9th percentile) suggests a low likelihood of imminent mass exploitation; however, the simplicity of crafting the malicious TNEF file and the availability of the vulnerable code in default Roundcube installations warrant prompt patching, particularly for internet-exposed deployments.