CVE-2026-62642

—

CVSS 3.1

6.5 medium

EPSS

<1%p42

Published

Jul 14, 2026 (Jul 14, 2026)

Modified

Jul 20, 2026

Description

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment.

Vendors: roundcube
Products: webmail
Weakness: CWE-835
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.