EUVD-2026-104795
GHSA-q9jg-8mw4-m3mw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted RTF to victim
-
ExploitVictim opens file with UnRTF
-
ExecutionTrigger out-of-bounds write in parser
-
ImpactMemory corruption crashes process (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to process an attacker-controlled, maliciously crafted RTF file using UnRTF (standalone or embedded in a conversion workflow) - this is the explicit condition from the description ('If a user opens an RTF file crafted by an attacker'). No special product configuration or authentication is needed (PR:N), but active user interaction is required (UI:A), which is the primary limiting factor. The realistic impact is limited to a denial-of-service crash of the UnRTF process; there is no evidence in the available data of code execution, data disclosure, or persistence. |
| Impact | This is a moderate, low-priority issue despite the memory-corruption primitive (CWE-787 out-of-bounds write). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L) scores 5.1 (Medium); the key risk-reducers are the mandatory user interaction (UI:A - a victim must actively process an attacker-crafted RTF file) and the fact that the vendor/description scope the outcome to denial-of-service only, not code execution, with no confidentiality impact (VC:N) and only Low integrity/availability impact. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit (POC) is referenced, so exploitation status is 'no public exploit identified at time of analysis.' Signals are internally consistent: a medium-severity, DoS-only file-parsing bug in a niche utility, reported through coordinated disclosure (JPCERT/JVN) rather than observed in attacks. One caveat to verify: the vector is rated AV:N, but UnRTF is a local command-line converter, so the 'network' rating reflects remote delivery of the malicious file (e.g., email attachment) rather than a listening network service - the actual trigger is local file processing with user interaction. |
| Exploit ScenarioDerived | An attacker emails or hosts a specially crafted RTF document and convinces a victim to convert it with UnRTF (directly or via an automated document-processing pipeline that calls UnRTF). Parsing the malformed RTF triggers an out-of-bounds write that corrupts memory and crashes the process, causing denial of service. No public exploit code is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
An out-of-bounds write in GNU UnRTF, the command-line RTF-to-HTML/text converter, can crash the process when a user converts a maliciously crafted RTF file, producing a denial-of-service condition. The flaw affects UnRTF releases tracked under the generic GNU Project CPE (no fixed version range is enumerated in the source data) and is reachable without authentication, but requires the victim to open or process the attacker-supplied RTF file. No public exploit code or confirmed active exploitation is identified at time of analysis, and the realistic impact is limited to loss of availability of the conversion process rather than code execution or data disclosure.
RemediationAI
Check the GNU Savannah advisory (https://savannah.gnu.org/news/?id=10925) and the JVN#29783594 page (https://jvn.jp/en/jp/JVN29783594/) for the vendor-released fix version and upgrade UnRTF to that build; the source data does not specify an exact patch version, so do not assume a particular release number is fixed. If an update cannot be applied promptly, treat untrusted RTF as hostile input: route conversions through a sandboxed or unprivileged account with resource limits (ulimit/container memory and CPU caps) so a crash cannot affect other services, and reject or quarantine unsolicited RTF attachments at the mail gateway - the trade-off is reduced document-conversion functionality for legitimate users. Disabling or removing UnRTF from automated mail-filter pipelines that process external mail eliminates the exposure entirely at the cost of losing RTF-to-HTML conversion for inbound messages. Monitor for repeated converter crashes as an indicator of attempted exploitation, and apply any future UnRTF security release as soon as it is published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
UnRTF is a GNU Project C library and standalone utility that parses Rich Text Format documents and emits HTML, plain text, LaTeX, or troff output; it is also embedded in mail filters and document-conversion pipelines. The reported weakness is CWE-787 (out-of-bounds write), a memory-corruption class in which the parser writes past the bounds of an allocated buffer while handling attacker-controlled RTF constructs - typically group braces, control words, font/color tables, or embedded picture data whose declared sizes are not validated against the destination buffer. Because the root cause is a write beyond an allocation, the observable effect in practice is heap or stack corruption leading to a crash (DoS); while memory corruption can in principle be a precursor to code execution, the available data - including the JVN and GNU Savannah advisories - supports only an availability impact, so exploitation for code execution should not be assumed. Note that a CVSS 4.0 vector of 5.1 was published alongside the CVE, while independent assessment based on the CVSS 3.1 vector places the issue at AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, i.e., network-deliverable but requiring user interaction and affecting only integrity/availability at low severity.
Know when Unrtf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Malicious RTF is delivered remotely but requires the user to process it (UI:R, PR:N); description scopes impact to a DoS crash, so C:N/I:N and A:L only.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
2DescriptionCVE.org
UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may lead to a denial-of-service (DoS) condition.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
UnRTF allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code as demonstrated b
UnRTF allows remote attackers to cause a denial of service (out-of-bounds memory access and crash) and possibly execute
Multiple stack-based buffer overflows in unrtf 0.21.9 allow remote attackers to cause a denial-of-service by writing a n
Exploit-DB