CVE-2026-62642 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, a… | CVSS 4.3 MEDIUM

Description

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment.

Metadata

CVE ID: CVE-2026-62642
State: PUBLISHED
Assigner: mitre
Reserved: 2026-07-14 15:49 UTC
Published: 2026-07-14 15:49 UTC
Last updated: 2026-07-14 17:18 UTC
Primary CWE: CWE-835
CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop…
Vendor / Product: Roundcube / Webmail
Sources: cve.org · NVD

Severity & Metrics

4.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
Roundcube	Webmail	—	1.6.0 < 1.6.17, 1.7.0 < 1.7.2

Weakness (CWE)

CWE	Source	Description
CWE-835	cna	CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

CVSS scores (1)

Score	Severity	Version	Source	Vector
4.3	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

References (7)