What is CVE-2026-62642?

CVE-2026-62642 is a medium-severity vulnerability in Roundcube Webmail, classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 4.3/10. Published 2026-07-14.

How severe is CVE-2026-62642?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Vulnerability in Roundcube Webmail

CVE-2026-62642

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L.

Affected products

Roundcube Webmail — versions 1.6.0, 1.7.0

Weakness classification (CWE)

CWE-835 — Loop with Unreachable Exit Condition (Infinite Loop)

References

cve@mitre.org
cve@mitre.org
cve@mitre.org
cve@mitre.org
cve@mitre.org
cve@mitre.org
cve@mitre.org

Frequently asked questions

What is CVE-2026-62642?: CVE-2026-62642 is a medium-severity vulnerability in Roundcube Webmail, classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 4.3/10. Published 2026-07-14.
How severe is CVE-2026-62642?: Medium severity. CVSS v3 base score is 4.3 out of 10.