{"action":"Upgrade libytnef to 1.9.3-3 or later.","affected":[{"fixed":"1.9.3-3","introduced":"0"}],"component":"libytnef","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["1.9.3-3"],"id":"tcs_01M5NFR4RF0632PH7BSY7BVJKK","modified_at":"2026-10-23T18:03:26.864723125Z","published_at":"2021-03-04T22:15:14.577Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2021-3403","https://security-tracker.debian.org/tracker/CVE-2021-3403"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2021-3403#Debian:14/libytnef","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2021-3403"}],"summary":"In ytnef 1.9.3, the TNEFSubjectHandler function in lib/ytnef.c allows remote attackers to cause a denial-of-service (and potentially code execution) due to a double free which can be triggered via a c"}