The vulnerability is a heap‑based out‑of‑bounds read triggered by an improper bounds check in wvGetSTSH in the stylesheet.c source of wvWare wv up to version 1.2.9. Attackers supply a Word document containing a crafted styles section with ten or fewer styles or out‑of‑range style base indexes. When the application processes the file, it reads past the allocated heap array, causing a crash. This results in a denial of service for any user who opens the file, with no data disclosure or code execution. The weakness corresponds to CWE‑125.

The affected product is wvWare wv, version 1.2.9 or earlier. The vulnerability manifests in applications that use the wv library for rendering Word documents, notably AbiWord. Users of older AbiWord releases that embed wv without patching are exposed.

The CVSS score of 6.8 indicates moderate severity, with the primary impact being an application crash. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited current exploitation. The likely attack vector is a local user opening a crafted .doc file, either via a link, email attachment, or manual file copy. Exploitation requires the victim to trigger the document parsing; it does not provide remote code execution or persistent compromise.