Medium severity · published Jul 14, 2026
CVE-2026-62642
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a…
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Webmail · Roundcube
1.6.0 before 1.6.17; 1.7.0 before 1.7.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-62642
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-62642
Patch
https://github.com/roundcube/roundcubemail/commit/132ac8dd5a55c8466be12de1daf84355697ffa89
Patch
https://github.com/roundcube/roundcubemail/commit/877269c79359d959a94f13c9070cab0f3389c193
Patch
https://github.com/roundcube/roundcubemail/commit/a007321346380136b3de2bd75b486b04f63c0d38
Patch
https://github.com/roundcube/roundcubemail/commit/fb952956c6eaf29e963f1a718d028d66e7957ce0
Release Notes
https://github.com/roundcube/roundcubemail/releases/tag/1.6.17
Release Notes
https://github.com/roundcube/roundcubemail/releases/tag/1.7.2
More from Webmail
9.8
CVE-2021-44026
Roundcube Webmail SQL Injection Vulnerability
9.8
CVE-2020-12641
Roundcube Webmail Remote Code Execution Vulnerability
9.3
CVE-2024-42009
RoundCube Webmail Cross-Site Scripting Vulnerability
8.8
CVE-2025-49113
RoundCube Webmail Deserialization of Untrusted Data Vulnerability
7.8
CVE-2017-16651
Roundcube Webmail File Disclosure Vulnerability