TNEF (winmail.dat) decoding endless loop #10193

message-from-inbox.txt

Prerequisites

• I have searched for duplicate or closed issues
• I can recreate the issue with all plugins disabled

Describe the issue

The problem occurs when parsing an attachment (TNEF / winmail.dat), specifically in the script /program/lib/Roundcube/rcube_tnef_decoder.php, where an infinite loop (100% CPU) occurs for 2 minutes until the script is forcibly terminated due to a 2-minute execution timeout.
This is not a general issue with all TNEF attachments, but only with some. I am attaching a sample message in which the described problem occurs.

What browser(s) are you seeing the problem on?

Chrome

What version of PHP are you using?

8.2

What version of Roundcube are you using?

1.6.15

JavaScript errors

No response

PHP errors

PHP timeout in the apache log:
[Tue Apr 21 14:17:34.750443 2026] [proxy_fcgi:error] [pid 1084630] [client aaa.bbb.ccc.ddd:10786] AH01071: Got error 'PHP message: PHP Fatal error: Maximum execution time of 120 seconds exceeded in /var/www/roundcube.no-sso/program/lib/Roundcube/rcube_tnef_decoder.php on line 217', referer: https://webmail.xxx.yy/?_task=mail&_mbox=INBOX