ytnef through 2.1.2 contains a heap out‑of‑bounds read in the DecompressRTF() function. The function never validates the uncompressedSize of an RTF stream, enabling an attacker to read memory beyond the intended buffer. This flaw can leak data stored adjacent on the heap and cause ytnefprint or any libytnef caller to crash.

The vulnerability affects all releases of Yeraze's ytnef up to and including version 2.1.2.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1% shows a low likelihood of exploitation at present. The issue is not listed in the CISA KEV catalog. Attacks require the attacker to supply a crafted winmail.dat TNEF attachment containing a malicious PT_BINARY MAPI property; when ytnef processes such a file on a target system, it can read arbitrary heap data and terminate unexpectedly. The exploit path hinges on the ability to feed the vulnerable function with an invalid uncompressedSize value, which is not checked.