The vulnerability is a stack‑based out‑of‑bounds read in wvGetPAPX_FKP and wvGetCHPX_FKP caused by an unchecked FKP run count. Attackers can craft a .doc file containing a large crun value that forces the program to read beyond the 512‑byte buffer, resulting in memory corruption that crashes the application. The primary impact is denial of service to users of AbiWord or other programs that rely on wvWare for opening Word documents.

Any system running wvWare wv on or before version 1.2.9 is affected. The vulnerability also impacts systems that use AbiWord or other applications that integrate wvWare to parse Office documents, because such applications will invoke the vulnerable functions when opening a crafted document. The specific affected product is wvWare wv up to and including 1.2.9; no later releases are documented as vulnerable.

The CVSS score for this issue is 6.8, indicating medium severity. Because the EPSS score is not available, the likelihood of exploitation is uncertain, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through a user‑supplied .doc file – an attacker can send or embed a crafted document that, when opened by a victim using a vulnerable version of wvWare, triggers an out‑of‑bounds read that crashes the application. The lack of a remote code execution vector limits the threat to local denial of service, but the vulnerability can still be abused by malicious file creators or phishing campaigns.