Description
Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF records in a tiny buffer, causing reads past the heap allocation that crash the process.
Published: 2026-10-16
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information disclosure and potential denial of service
Action: Upgrade
AI Analysis

Impact

Antiword versions up to 0.37 contain a heap out‑of‑bounds read in the vGet8LstInfo function of prop8.c, triggered by an inverted bounds check on the PlcfLst record count (CWE‑125). A crafted Word 8 .doc file that claims to contain up to 0xFFFF LSTF records can cause antiword to read past the allocated buffer, leaking arbitrary heap contents and provoking a crash. The read allows an attacker to gain sensitive data, while the crash can be used for denial of service.

Affected Systems

The vulnerability affects Adri van Os antiword 0.37 and earlier. No later releases are reported as vulnerable, and the issue is specific to the 0.37 release.

Risk and Exploitability

The CVSS score of 6.8 indicates moderate severity. EPSS data is unavailable and the issue is not listed in the CISA KEV catalog, suggesting limited exploitation to date. The likely attack vector is a local or remote user providing a malicious .doc file to antiword; no remote code execution is described.

Generated by OpenCVE AI on October 16, 2026 at 19:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade antiword to a version newer than 0.37 that removes the vulnerable code.
  • If an upgrade cannot be performed immediately, consult the vendor’s source repository for commits that fix the bounds check in vGet8LstInfo and rebuild the binary from the patched source.
  • Implement input validation for Word 8 files by rejecting documents that declare an excessively high number of LSTF records or by imposing a maximum record count to prevent heap overreads.

Generated by OpenCVE AI on October 16, 2026 at 19:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Antiword Project
Antiword Project antiword
CPEs cpe:2.3:a:antiword_project:antiword:*:*:*:*:*:*:*:*
Vendors & Products Antiword Project
Antiword Project antiword

Mon, 19 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Adri Van Os
Adri Van Os antiword
Vendors & Products Adri Van Os
Adri Van Os antiword

Sun, 18 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF records in a tiny buffer, causing reads past the heap allocation that crash the process.
Title Antiword through 0.37 Heap Out-of-Bounds Read via vGet8LstInfo in prop8.c
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Adri Van Os Antiword
Antiword Project Antiword
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-18T12:26:10.819Z

Reserved: 2026-10-16T14:31:18.550Z

Link: CVE-2026-111677

cve-icon Vulnrichment

Updated: 2026-10-16T18:30:53.255Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-16T18:17:50.477

Modified: 2026-10-20T19:08:12.820

Link: CVE-2026-111677

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T12:54:12Z

Weaknesses