Antiword CVE-2026-111677

Exploitation requires the target host to parse an attacker-supplied Word 8 (.doc) file with antiword ≤0.37 - a local/file-driven vector with passive user interaction (the victim or an automated pipeline must invoke antiword on the crafted file). The specific trigger is a .doc whose PlcfLst record-count field claims a large LSTF count (up to 0xffff) against an undersized buffer, hitting the inverted bounds check in vGet8LstInfo. No authentication is required of the attacker to craft the file (PR:N), but there is no remote network vector: the limiting factor is that a user or service must actually feed the malicious document to antiword. Impact is limited to a crash of that antiword process; no code execution or data disclosure is described.

This is a memory-safety denial-of-service issue, not a high-priority remote threat. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H, score 6.8) correctly models a LOCAL attack requiring the victim to process a crafted file (UI:P/passive), with impact confined to availability (process crash) and NO confidentiality or integrity impact - consistent with CWE-125 (out-of-bounds READ) manifesting as a crash rather than code execution or data theft. No EPSS score, KEV listing, or POC flag was provided in the input, so exploitation probability signals are absent. There is a public technical write-up (hackmd) and a VulnCheck advisory describing the root cause, but no public exploit identified at time of analysis. Signals are broadly consistent: low-severity, local, availability-only. One caveat - the input Tags include 'Information Disclosure,' but the description states the OOB read crashes the process rather than leaking data, and the CVSS sets VC:N; the disclosure framing is not supported by the described impact. Overall this is a low-to-moderate robustness bug, most relevant to automated document-processing pipelines, not an urgent patch-now item.

An attacker emails or uploads a malicious Word 8 .doc file whose PlcfLst header claims up to 0xffff LSTF records while the actual buffer is tiny. When a victim (or an automated server-side conversion/indexing pipeline) runs antiword on the file, the inverted bounds check in vGet8LstInfo causes reads past the heap allocation, crashing the process. No public exploit code is identified, and the impact is limited to a denial-of-service crash rather than code execution.