Description
Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded. Attackers can supply a crafted .doc file with malicious FKP pages to read past the 512-byte stack buffer, crashing antiword or corrupting style parsing.
Published: 2026-10-16
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via stack out‑of‑bounds read
Action: Patch or Upgrade
AI Analysis

Impact

Antiword through 0.37 contains a stack out‑of‑bounds read that occurs in the functions vGet8PapInfo and vGet8ChrInfo in prop8.c. The flaw arises because the FKP run counts and grpprl offsets are not bounded, allowing an attacker to craft a .doc file that causes antiword to read past the 512‑byte stack buffer. The result can be a crash or corruption of style parsing, and the bug is categorized as CWE‑125.

Affected Systems

The vulnerable product is antiword released by Adri van Os. Versions up to and including 0.37 are affected. No further version granularities are specified in the available data.

Risk and Exploitability

The exploit requires an attacker to supply a malicious .doc file to an instance of antiword; the vulnerability can be triggered simply by processing the crafted file. No user interaction or elevated privileges are needed. The CVSS score of 4.8 indicates moderate severity, while no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Consequently the likelihood of widespread exploitation is low, but the risk remains for environments that rely on legacy antiword deployments for document conversion.

Generated by OpenCVE AI on October 16, 2026 at 19:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a later antiword release that supersedes 0.37, if available, to eliminate the bounds‑checking vulnerability.
  • If an upgrade is not immediately feasible, run antiword in a sandboxed or isolated environment and restrict it to processing only trusted documents; do not allow untrusted files to be parsed directly.
  • Validate the structure of .doc files before handing them to antiword – for example, check that FKP run counts and grpprl offsets fall within acceptable bounds and reject any file that appears to violate these limits.
  • Consider replacing antiword with a modern, actively maintained document parsing library that enforces strict bounds checking and receives regular security updates.

Generated by OpenCVE AI on October 16, 2026 at 19:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Antiword Project
Antiword Project antiword
CPEs cpe:2.3:a:antiword_project:antiword:*:*:*:*:*:*:*:*
Vendors & Products Antiword Project
Antiword Project antiword

Mon, 19 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Adri Van Os
Adri Van Os antiword
Vendors & Products Adri Van Os
Adri Van Os antiword

Fri, 16 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded. Attackers can supply a crafted .doc file with malicious FKP pages to read past the 512-byte stack buffer, crashing antiword or corrupting style parsing.
Title Antiword through 0.37 Stack Out-of-Bounds Read via prop8.c FKP Parsing
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Adri Van Os Antiword
Antiword Project Antiword
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-23T14:03:28.591Z

Reserved: 2026-10-16T14:31:18.687Z

Link: CVE-2026-111678

cve-icon Vulnrichment

Updated: 2026-10-23T14:02:53.896Z

cve-icon NVD

Status : Modified

Published: 2026-10-16T18:17:50.627

Modified: 2026-10-23T15:17:24.320

Link: CVE-2026-111678

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T12:54:10Z

Weaknesses