CVE-2026-62641: Roundcube Webmail DoS Vulnerability

CVE-2026-62641 Overview

CVE-2026-62641 is a denial of service vulnerability in Roundcube Webmail affecting versions before 1.6.17 and 1.7.x before 1.7.2. The flaw resides in the TNEF (Transport Neutral Encapsulation Format) decoder, which processes winmail.dat attachments commonly sent by Microsoft Outlook clients. An attacker can craft a malicious compressed-RTF size field within a TNEF attachment to trigger resource exhaustion during decoding. Successful exploitation causes the webmail process to consume excessive resources when a victim opens or previews a crafted message. The vulnerability is tracked under CWE-770: Allocation of Resources Without Limits or Throttling.

Critical Impact
A remote attacker can send a crafted email attachment that, when processed by the TNEF decoder, causes denial of service against the Roundcube Webmail server.

Affected Products

Roundcube Webmail versions prior to 1.6.17
Roundcube Webmail 1.7.x versions prior to 1.7.2
Deployments using the rcube_tnef_decoder component for winmail.dat handling

Discovery Timeline

2026-07-05 - Roundcube publishes security updates 1.6.17 and 1.7.2
2026-07-14 - CVE-2026-62641 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-62641

Vulnerability Analysis

The vulnerability is located in program/lib/Roundcube/rcube_tnef_decoder.php, which parses TNEF-encoded attachments carrying compressed Rich Text Format (RTF) content. The TNEF format includes a size field that indicates the expected length of the uncompressed RTF payload. Before the patch, the decoder trusted this size value without cross-checking it against the actual length of the input buffer.

When a crafted TNEF attachment specifies an inflated compressed-RTF size, the decoder enters a decompression loop that attempts to produce output well beyond the size of the source data. This behavior results in excessive CPU and memory consumption on the server processing the message. Because Roundcube runs server-side to render message previews, the impact is felt on the webmail host rather than the client.

Root Cause

The root cause is missing validation of an attacker-controlled length field against the actual buffer size. Without bounding the decompression loop by the true input length, the parser processes far more iterations than the underlying data supports, exhausting available resources.

Attack Vector

Exploitation requires an attacker to send an email containing a crafted winmail.dat TNEF attachment to a user of a vulnerable Roundcube Webmail instance. When the recipient opens or previews the message, the server-side decoder is invoked and enters the resource-exhaustion condition. No authentication is required on the attacker side, but user interaction is required on the victim side.

php

         $uncomp = '';
         $preload = "{\\rtf1\\ansi\\mac\\deff0\\deftab720{\\fonttbl;}{\\f0\\fnil \\froman \\fswiss \\fmodern \\fscript \\fdecor MS Sans SerifSymbolArialTimes New RomanCourier{\\colortbl\\red0\\green0\\blue0\n\r\\par \\pard\\plain\\f0\\fs20\\b\\i\\u\\tab\\tx";
         $length_preload = strlen($preload);
+        $max_len = strlen($data);
 
         for ($cnt = 0; $cnt < $length_preload; $cnt++) {
             $uncomp .= $preload[$cnt];

Source: Roundcube commit 6d1004fd

The patch introduces $max_len = strlen($data);, capturing the real length of the input buffer so the decompression loop can be bounded against the actual data size rather than the attacker-supplied field.

Detection Methods for CVE-2026-62641

Indicators of Compromise

Inbound email messages containing winmail.dat or application/ms-tnef attachments from untrusted senders
Sustained high CPU or memory usage by PHP-FPM or Apache worker processes tied to Roundcube requests
Roundcube error logs referencing rcube_tnef_decoder or timeouts during message rendering
Repeated HTTP 500 or gateway timeout responses when specific messages are opened

Detection Strategies

Inspect mail gateway logs for TNEF attachments delivered to Roundcube users and correlate them with server resource spikes
Deploy application performance monitoring on the Roundcube host to flag long-running PHP requests handling message previews
Enable Roundcube debug logging temporarily to capture parser behavior when suspected messages are processed

Monitoring Recommendations

Track version strings of Roundcube installations across the estate and alert on hosts running versions below 1.6.17 or 1.7.2
Monitor for anomalous PHP process termination or OOM killer events on webmail servers
Baseline normal CPU and memory usage for the webmail tier and alert on sustained deviations

How to Mitigate CVE-2026-62641

Immediate Actions Required

Upgrade Roundcube Webmail to version 1.6.17 or 1.7.2 as published in the Roundcube Security Updates Announcement
Inventory all Roundcube instances, including containerized and appliance-based deployments, to confirm patched versions are running
Apply resource limits such as memory_limit and max_execution_time in PHP configuration to constrain worst-case impact

Patch Information

Roundcube released fixes on 2026-07-05 in Roundcube Release 1.6.17 and Roundcube Release 1.7.2. The relevant code changes are in commits 6d1004fd and bf253c72, which add a $max_len bound derived from the actual input data length.

Workarounds

Strip or quarantine winmail.dat and application/ms-tnef attachments at the mail gateway until patches are applied
Disable TNEF decoding in the Roundcube configuration if the feature is not required by end users
Place a reverse proxy in front of Roundcube with per-request timeouts to bound resource usage during message rendering

bash

# Example PHP-FPM hardening to limit resource exhaustion impact
sed -i 's/^memory_limit = .*/memory_limit = 128M/' /etc/php/php.ini
sed -i 's/^max_execution_time = .*/max_execution_time = 30/' /etc/php/php.ini
systemctl restart php-fpm