CVE-2026-62642: Roundcube Webmail DOS Vulnerability

CVE-2026-62642 Overview

CVE-2026-62642 is a denial-of-service vulnerability in Roundcube Webmail affecting versions before 1.6.17 and 1.7.x before 1.7.2. The flaw resides in the Transport Neutral Encapsulation Format (TNEF) decoder used to parse winmail.dat attachments. A malformed TNEF attachment triggers an infinite loop in the parser, exhausting CPU resources when a user opens the email. The issue is tracked as CWE-835: Loop with Unreachable Exit Condition. Exploitation requires user interaction — opening the crafted email — but no authentication against the target server is needed by the attacker who sends the message.

Critical Impact
Remote attackers can send a specially crafted email with a malicious TNEF attachment to cause CPU exhaustion in the Roundcube backend when a recipient opens it, leading to denial of service for the webmail process handling the request.

Affected Products

Roundcube Webmail versions prior to 1.6.17
Roundcube Webmail 1.7.x versions prior to 1.7.2
Deployments processing TNEF (winmail.dat) attachments via rcube_tnef_decoder.php

Discovery Timeline

2026-07-05 - Roundcube publishes security updates 1.6.17 and 1.7.2
2026-07-14 - CVE-2026-62642 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-62642

Vulnerability Analysis

The vulnerability lives in program/lib/Roundcube/rcube_tnef_decoder.php, the pure-PHP decoder Roundcube uses to render Microsoft Outlook winmail.dat attachments. The decoder reads TNEF records by pulling a caller-specified number of bytes from an in-memory buffer. When the requested byte count exceeds the remaining buffer length, the original code returned null without advancing the read pointer. Callers within the parser interpreted null as a recoverable condition and re-entered the read loop, producing an unbounded iteration on truncated or malformed TNEF streams.

Because TNEF parsing runs synchronously when a message with application/ms-tnef content is opened, the affected PHP worker consumes 100% CPU until the process is killed or a request timeout fires. Multiple concurrent malicious messages can saturate all PHP-FPM workers and deny service to legitimate users of the webmail instance.

Root Cause

The root cause is a boundary check that guarded reads but not loop progress. When strlen($data) < $bytes, the function returned early without consuming any data or signaling end-of-stream, so the outer parsing loop repeated the same read forever. This is a classic [CWE-835] loop-with-unreachable-exit-condition pattern in binary format parsing.

Attack Vector

An attacker sends an email containing a crafted TNEF (winmail.dat) attachment to any address served by a vulnerable Roundcube instance. When a user opens the message in the web interface, the server-side decoder enters the infinite loop. No credentials, no prior access, and no interaction beyond opening the message are required.

php

// Patch: program/lib/Roundcube/rcube_tnef_decoder.php
// Source: https://github.com/roundcube/roundcubemail/commit/877269c79359d959a94f13c9070cab0f3389c193
    {
        $value = null;

-        if (strlen($data) >= $bytes) {
+        if (strlen($data)) {
            $value = substr($data, 0, $bytes);
-            $data = substr($data, $bytes);
+            $data = substr($data, strlen($value));
        }

        return $value;

The fix changes the guard so that any non-empty buffer produces a read, and the buffer advances by the actual length of the substring returned. Even when fewer than $bytes are available, $data is now consumed and eventually becomes empty, allowing the parser loop to terminate.

Detection Methods for CVE-2026-62642

Indicators of Compromise

Inbound messages containing application/ms-tnef or application/vnd.ms-tnef attachments with truncated or malformed TNEF headers.
PHP-FPM or Apache worker processes running rcube_tnef_decoder.php frames sustained at 100% CPU.
Repeated HTTP 504 or gateway timeouts on Roundcube mail-view endpoints such as ?_task=mail&_action=show.

Detection Strategies

Inspect mail gateway logs for winmail.dat attachments arriving from untrusted senders and correlate with webmail access spikes.
Instrument PHP with slow-request logging to capture stack traces stuck in rcube_tnef_decoder methods.
Alert on abnormal ratios of long-running Roundcube requests versus normal message-open latency baselines.

Monitoring Recommendations

Monitor CPU utilization per PHP worker and configure request_terminate_timeout alerts.
Track the version string of deployed Roundcube instances and flag any below 1.6.17 or 1.7.2.
Log and review 5xx responses from /roundcube/ endpoints, particularly during message rendering.

How to Mitigate CVE-2026-62642

Immediate Actions Required

Upgrade Roundcube Webmail to 1.6.17 or 1.7.2 as published in the Roundcube Security Updates advisory.
If immediate patching is not possible, disable TNEF attachment rendering by removing or restricting the TNEF decoder path.
Enforce a strict max_execution_time and request_terminate_timeout in PHP-FPM to bound the impact of any stuck request.

Patch Information

Roundcube released fixes on 2026-07-05 in versions 1.6.17 and 1.7.2. The relevant commits are 877269c7, a0073213, 132ac8dd, and fb952956, which modify program/lib/Roundcube/rcube_tnef_decoder.php to guarantee buffer progress on every read.

Workarounds

Strip application/ms-tnef and application/vnd.ms-tnef attachments at the mail gateway before delivery to Roundcube users.
Lower PHP max_execution_time in the Roundcube pool so runaway parses are terminated before they cause user-visible outages.
Restrict inbound mail from untrusted external domains to authenticated senders and rate-limit connections to reduce mass-DoS exposure.

bash

# Upgrade Roundcube on a typical Linux deployment
cd /var/www
wget https://github.com/roundcube/roundcubemail/releases/download/1.6.17/roundcubemail-1.6.17-complete.tar.gz
tar -xzf roundcubemail-1.6.17-complete.tar.gz

# Preserve config and swap the webroot
cp -a roundcubemail/config/config.inc.php roundcubemail-1.6.17/config/
mv roundcubemail roundcubemail.old
mv roundcubemail-1.6.17 roundcubemail

# Harden PHP-FPM against parser DoS
# /etc/php/8.2/fpm/pool.d/roundcube.conf
request_terminate_timeout = 30s
php_admin_value[max_execution_time] = 30
systemctl reload php8.2-fpm