CVE-2017-6309: An issue was discovered in tnef before 1.4.13.

Security readout for executives and security teams

CVE-2017-6309 affects tnef before 1.4.13. A crafted input processed by tnef could trigger type confusion in file parsing, causing attacker-controlled invalid memory reads or writes. The supplied sources do not provide a CVSS score or confirmed real-world exploitation. Exposure is most likely where systems, mail-processing workflows, or user endpoints run tnef before 1.4.13 against untrusted TNEF content. The supplied affected-product metadata is incomplete, so confirm package names and versions from asset inventory and vendor advisories. Treat as a targeted patching item for environments that process untrusted TNEF content. It is not KEV-listed in the supplied data, but attacker-controlled invalid reads and writes justify timely remediation on exposed systems. Mitigation focus: Upgrade tnef to 1.4.13 or a vendor-fixed package.; Apply relevant Debian or Gentoo security updates where those distributions are used.; Limit automated parsing of untrusted TNEF content until patched..

Prepared

Jun 13, 2026, 06:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.