--- title: "The Payload in the Envelope – An OLE Object Inside winmail.dat: How TNEF Hides What a Mail Carries" description: Outlook unpacks winmail.dat and shows what is inside, including an OLE object with a Word icon that starts a program on a double-click. image: https://explore.bowbridge.net/hubfs/Blog/File%20Security%20101/Headers/File%20Security%20101%20-%20Blog%20Header.jpeg --- [customer login](https://www.bowbridge.net/customer-portal/) english deutsch [![bowbridge](https://explore.bowbridge.net/hubfs/logos/bowbridge_logo.svg "bowbridge")](https://www.bowbridge.net/en/) - [Solutions](https://www.bowbridge.net/en/sap-cybersecurity-solutions/) - [Anti-Virus - Cloud](https://www.bowbridge.net/en/anti-virus-cloud-for-sap-solutions/) - [Anti-Virus for SAP Solutions](https://www.bowbridge.net/en/anti-virus-for-sap-solutions/) - [Application Security for SAP Solutions](https://www.bowbridge.net/en/application-security-for-sap-solutions/) - [Resources](https://www.bowbridge.net/en/sap-cybersecurity-resources/) - [Blog](https://explore.bowbridge.net/blog) - [Protecting SAP Applications from Content-Based Attacks](https://www.bowbridge.net/en/guide-to-content-based-attacks-sap-applications/) - [Intro to FIORI Cybersecurity](https://www.bowbridge.net/en/guide-to-sap-fiori-cybersecurity/) - [Case Studies](https://www.bowbridge.net/en/sap-cybersecurity-resources/#casestudies) - [White Papers](https://www.bowbridge.net/en/sap-cybersecurity-resources/#wp) - [Webinars](https://www.bowbridge.net/en/sap-cybersecurity-resources/#webinars) - [Partner Resources](https://www.bowbridge.net/en/bowbridge-partner-resources/) - [About](https://www.bowbridge.net/en/about-bowbridge-software/) - [Company Profile](https://www.bowbridge.net/en/company-profile/) - [Customers](https://www.bowbridge.net/en/customers/) - [News](https://explore.bowbridge.net/news) - [Careers](https://www.bowbridge.net/en/careers/) - [Support](https://www.bowbridge.net/en/sap-cybersecurity-support/) - [Software Downloads](https://www.bowbridge.net/en/bowbridge-downloads/) - [Documentation](https://www.bowbridge.net/en/bowbridge-documentation/) - [Support Videos](https://www.bowbridge.net/en/bowbridge-support-videos/) - [Contact Technical Support](https://www.bowbridge.net/en/sap-cybersecurity-support/#form) - [Contact](https://www.bowbridge.net/en/contact-bowbridge/) - [DE](https://www.bowbridge.net/de/) - [EN](https://www.bowbridge.net/en/news.html) - [Solutions](https://www.bowbridge.net/en/sap-cybersecurity-solutions/) - [Anti-Virus - Cloud](https://www.bowbridge.net/en/anti-virus-cloud-for-sap-solutions/) - [Anti-Virus for SAP Solutions](https://www.bowbridge.net/en/anti-virus-for-sap-solutions/) - [Application Security for SAP Solutions](https://www.bowbridge.net/en/application-security-for-sap-solutions/) - [Resources](https://www.bowbridge.net/en/sap-cybersecurity-resources/) - [Blog](https://explore.bowbridge.net/blog) - [Protecting SAP Applications from Content-Based Attacks](https://www.bowbridge.net/en/guide-to-content-based-attacks-sap-applications/) - [Intro to FIORI Cybersecurity](https://www.bowbridge.net/en/guide-to-sap-fiori-cybersecurity/) - [Case Studies](https://www.bowbridge.net/en/sap-cybersecurity-resources/#casestudies) - [White Papers](https://www.bowbridge.net/en/sap-cybersecurity-resources/#wp) - [Webinars](https://www.bowbridge.net/en/sap-cybersecurity-resources/#webinars) - [Partner Resources](https://www.bowbridge.net/en/bowbridge-partner-resources/) - [About](https://www.bowbridge.net/en/about-bowbridge-software/) - [Company Profile](https://www.bowbridge.net/en/company-profile/) - [Customers](https://www.bowbridge.net/en/customers/) - [News](https://explore.bowbridge.net/news) - [Careers](https://www.bowbridge.net/en/careers/) - [Support](https://www.bowbridge.net/en/sap-cybersecurity-support/) - [Software Downloads](https://www.bowbridge.net/en/bowbridge-downloads/) - [Documentation](https://www.bowbridge.net/en/bowbridge-documentation/) - [Support Videos](https://www.bowbridge.net/en/bowbridge-support-videos/) - [Contact Technical Support](https://www.bowbridge.net/en/sap-cybersecurity-support/#form) - [Contact](https://www.bowbridge.net/en/contact-bowbridge/) ![File Security 101 – Threats Beyond Malware](https://explore.bowbridge.net/hs-fs/hubfs/Blog/File%20Security%20101/Headers/File%20Security%20101%20-%20Blog%20Header.jpeg?width=1800&height=500&name=File%20Security%20101%20-%20Blog%20Header.jpeg) # The Payload in the Envelope – An OLE Object Inside winmail.dat: How TNEF Hides What a Mail Carries Nov 13, 2026, 1:00:00 PM by Joerg Schneider-Simon Most people have seen an attachment called winmail.dat and learned to ignore it. Outlook does not ignore it: it opens it and shows what is inside. This is episode 5 of File Security 101, our series on file-based threats your anti-malware does not see. The video explains it in about two minutes. The article adds the details and the research behind it. ## An attachment called winmail.dat Many mail programs show a message from Outlook with a plain-text body and an attachment named `winmail.dat`, sometimes `ATT00008.DAT` or similar. Opened in those programs, the file shows nothing useful. In Outlook, the same message looks different: there is no winmail.dat, only the attachments it contained, for example a document with a familiar icon. ## TNEF: Outlook's private envelope Winmail.dat is TNEF, the Transport Neutral Encapsulation Format. Outlook uses it to package what standard MIME cannot express: formatted text, Outlook-specific features such as voting buttons, regular file attachments and OLE objects ([Microsoft](https://learn.microsoft.com/en-us/outlook/troubleshoot/message-body/how-tnef-affects-email-messages)). In a MIME message it travels as a part of type `application/ms-tnef`, usually named winmail.dat. Inside, TNEF is a binary stream that starts with the signature `0x223E9F78`, followed by attributes: the message class, the body, and for every attachment a block that says whether it is a file or an OLE object, its title, its data, and a Windows metafile that Outlook draws as its icon. OLE objects are items that open in their own program, such as a document embedded in a mail. The icon is stored separately from the object; for embedded OLE objects it is simply a picture to draw ([Microsoft](https://learn.microsoft.com/en-us/office/client-developer/outlook/mapi/pidtagattachrendering-canonical-property)). ## The attack: a payload in the envelope The attacker builds a TNEF stream by hand and places an OLE object in it, for example a program wrapped as an OLE Package, the object type from episode 3. The metafile picture shows a Word icon, and the title says `Order-4471.docx`. Outlook unpacks the envelope and shows a document. A double-click activates the object, the program starts, and the attacker's code runs with the user's rights. ## It happened In December 2015, security researcher Haifei Li published BadWinmail ([Kaspersky](https://www.kaspersky.com/blog/badwinmail-outlook/4954/), [SecurityWeek](https://www.securityweek.com/badwinmail-outlook-flaw-puts-enterprises-risk/)). He showed that an OLE object inside a TNEF message could be loaded as soon as Outlook displayed the mail, including in the preview pane. Using a Flash object, an attacker could run a Flash exploit inside Outlook and get past Outlook's protection against unsafe attachments. Li called it an "enterprise killer". Microsoft fixed the flaw in bulletin [MS15-131](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-131) on December 8, 2015, as CVE-2015-6172; the bulletin states that a user had to open or preview a specially crafted message. TNEF had been a target before. In January 2006, Microsoft fixed CVE-2006-0002 in bulletin [MS06-003](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-003): a flaw in the way Outlook and Exchange Server decoded TNEF itself. In Outlook, opening or previewing a crafted message was enough; on affected Exchange servers, the message could be exploited without any user interaction when the server processed it. ## Why it slips through This attack carries real code, and it still gets through for structural reasons. Filters that block dangerous attachments by name see `winmail.dat`, not a program. A scanner that does not decode TNEF sees one opaque block of binary data and never looks at the objects inside it. Microsoft itself warned in MS06-003 that "filtering only for attachments that have the file name Winmail.dat may not be sufficient" and recommended blocking the `application/ms-tnef` content type as well. ## What to do - Check that your mail security decodes TNEF and inspects every attachment and OLE object inside it, not just the outer file. - If you do not need rich-text mail from outside your organization, block both the winmail.dat name and the `application/ms-tnef` content type at the gateway. Microsoft notes that rich-text (RTF) mail is then no longer received correctly. - Keep Outlook and Exchange up to date; both bugs above were fixed by regular updates. bowbridge Content Disarm and Reconstruct opens the TNEF envelope instead of passing it through. It rebuilds the text and each regular attachment by the rules for its own format. OLE objects and the icon metafiles are not carried over, and an executable attachment makes the whole file fail rather than pass. [Join the bowbridge CDR beta program](https://explore.bowbridge.net/en/cdr-beta) ## Sources - [How TNEF affects email messages](https://learn.microsoft.com/en-us/outlook/troubleshoot/message-body/how-tnef-affects-email-messages), Microsoft Learn - [PidTagAttachRendering canonical property](https://learn.microsoft.com/en-us/office/client-developer/outlook/mapi/pidtagattachrendering-canonical-property), Microsoft Learn - [BadWinmail: the really bad Outlook flaw](https://www.kaspersky.com/blog/badwinmail-outlook/4954/), Kaspersky official blog, December 16, 2015 - ["BadWinmail" Outlook flaw puts enterprises at risk](https://www.securityweek.com/badwinmail-outlook-flaw-puts-enterprises-risk/), SecurityWeek, December 18, 2015 - [Microsoft Security Bulletin MS15-131](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-131), Microsoft, December 8, 2015 - [Microsoft Security Bulletin MS06-003](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-003), Microsoft, January 10, 2006 ## Subscribe to upcoming episodes #### Share this on social: [Share via LinkedIn](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fexplore.bowbridge.net%2Ffile-security-101%2Fepisode-5-the-payload-in-the-envelope-an-ole-object-inside-winmail-dat&title=The+Payload+in+the+Envelope+%26ndash%3B+An+OLE+Object+Inside+winmail.dat%3A+How+TNEF+Hides+What+a+Mail+Carries&summary=Outlook+unpacks+winmail.dat+and+shows+what+is+inside%2C+including+an+OLE+object+with+a+Word+icon+that+starts+a+program+on+a+double-click.) [Share via Twitter](https://twitter.com/intent/tweet?url=https%3A%2F%2Fexplore.bowbridge.net%2Ffile-security-101%2Fepisode-5-the-payload-in-the-envelope-an-ole-object-inside-winmail-dat&text=The+Payload+in+the+Envelope+%26ndash%3B+An+OLE+Object+Inside+winmail.dat%3A+How+TNEF+Hides+What+a+Mail+Carries) [Share via Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fexplore.bowbridge.net%2Ffile-security-101%2Fepisode-5-the-payload-in-the-envelope-an-ole-object-inside-winmail-dat) [Share via Email](mailto:?subject=The+Payload+in+the+Envelope+%26ndash%3B+An+OLE+Object+Inside+winmail.dat%3A+How+TNEF+Hides+What+a+Mail+Carries&body=https%3A%2F%2Fexplore.bowbridge.net%2Ffile-security-101%2Fepisode-5-the-payload-in-the-envelope-an-ole-object-inside-winmail-dat) ### Don't miss the latest SAP security news #### bowbridge - [Solutions](https://www.bowbridge.net/en/sap-cybersecurity-solutions/) - [Resources](https://www.bowbridge.net/en/sap-cybersecurity-resources/) - [About bowbridge](https://www.bowbridge.net/en/about-bowbridge-software/) - [Support](https://www.bowbridge.net/en/sap-cybersecurity-support/) - [Contact](https://www.bowbridge.net/en/contact-bowbridge/) - [Customer Login](https://www.bowbridge.net/customer-portal/) #### Contact **GERMANY** Tel: +49 (0) 6227 - 69899 - 50 Fax: +49 (0) 6227 - 69899-59 Email: [info@bowbridge.net](mailto:info@bowbridge.net) **USA** Tel: +1 650 - 617 - 3408 Fax: +1 650 - 617 - 3201 Email: [us-sales@bowbridge.net](mailto:us-sales@bowbridge.net) #### Connect With Us - [English](https://www.bowbridge.net/en/) - [Deutsch](https://www.bowbridge.net/) Copyright © 2023 bowbridge Software GmbH. All rights reserved. [Privacy Policy](https://www.bowbridge.net/en/privacy-policy) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Joerg Schneider-Simon", "url" : "https://explore.bowbridge.net/file-security-101/author/joerg-schneider-simon" }, "dateModified" : "2026-11-13T15:55:53.285Z", "datePublished" : "2026-11-13T12:00:00.000Z", "headline" : "The Payload in the Envelope – An OLE Object Inside winmail.dat: How TNEF Hides What a Mail Carries", "image" : [ "https://explore.bowbridge.net/hubfs/Blog/File%20Security%20101/Headers/File%20Security%20101%20-%20Blog%20Header.jpeg" ], "mainEntityOfPage" : { "@id" : "https://explore.bowbridge.net/file-security-101/episode-5-the-payload-in-the-envelope-an-ole-object-inside-winmail-dat", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://explore.bowbridge.net/hubfs/bowbridge_logo_2-1.png" }, "name" : "bowbridge Software GmbH" } } ```