EUVD-2026-102969
GHSA-gmg3-h7rv-2cc6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted .doc to victim
-
DeliveryVictim opens file with antiword
-
ExploitUnbounded FKP run count read past stack buffer
-
ExecutionOut-of-bounds read in prop8.c parsing
-
ImpactProcess crash or corrupted style parsing
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a victim to process an attacker-supplied, specially crafted .doc file (with malformed FKP pages whose run counts and grpprl offsets exceed bounds) using antiword version 0.37 or earlier. No special product configuration is needed - default parsing of any .doc file is sufficient - but exploitation is gated by local file delivery and the victim actually invoking antiword on the file (UI:P, AV:L). The impact is limited to crashing antiword or corrupting style parsing (availability only); the CVSS vector indicates no confidentiality or integrity impact and no code execution, which substantially limits real-world risk. |
| Impact | This is a low-to-moderate priority issue, and the CVSS 4.0 base score of 4.8 (MEDIUM) likely overstates its operational urgency. The provided vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L is internally consistent with the description: exploitation is LOCAL (AV:L) because an attacker must get a crafted .doc file in front of a victim who processes it with antiword, requires passive user interaction (UI:P), and yields ONLY a low availability impact (VA:L) - the program crashes. Critically, there is NO confidentiality impact (VC:N) despite the 'Information Disclosure' tag and the out-of-bounds READ nature (CWE-125); the vendor-assigned vector models the realistic outcome as a crash or corrupted style parsing, not attacker-recoverable data leakage. No EPSS score was provided, the CVE is NOT on CISA KEV, and no exploit-code signal was supplied, so there is no public exploit identified at time of analysis. The reporting (VulnCheck advisory plus a detailed hackmd technical writeup and specific source-line references) demonstrates the bug is well understood but does not evidence active exploitation. Net: a genuine but low-severity memory-safety defect in a niche legacy utility - worth patching in distro packages but not an incident-response priority. |
| Exploit ScenarioDerived | An attacker crafts a malicious .doc file containing FKP pages with oversized run counts and unbounded grpprl offsets, then delivers it to a victim (e.g., via email or a file-conversion pipeline). When the victim runs antiword on the file, vGet8PapInfo/vGet8ChrInfo read past the 512-byte stack buffer, crashing the process or corrupting style parsing. No public exploit code was identified in the provided data, though a detailed technical writeup exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
A stack out-of-bounds read in Antiword 0.37 and earlier (prop8.c, vGet8PapInfo and vGet8ChrInfo) allows a crafted .doc file containing malformed FKP pages to drive run counts and grpprl offsets past the end of a 512-byte stack buffer, crashing the parser or corrupting style parsing. Exploitation is local and gated by user interaction: a victim must be given the file and invoke antiword on it (AV:L/UI:P), and the assessed impact is availability-only with no confidentiality, integrity, or code-execution effect. The attack is unauthenticated per the CVSS 4.0 vector (PR:N), no public exploit is identified at time of analysis, and the CVSS 4.0 base score of 4.8 (MEDIUM) likely overstates its operational urgency given the limited impact and delivery prerequisites.
RemediationAI
No vendor-released patch identified at time of analysis - the only references are upstream source locations and a vulnerability writeup, not a fixed tagged release - so remediation must rely on compensating controls until an updated antiword build appears. The most direct mitigation is to stop feeding untrusted .doc files to antiword: route document conversion through a maintained parser (for example LibreOffice or a current catdoc/libreoffice --headless pipeline) or pre-screen files with a Word 8 structure validator that rejects FKP pages whose run counts exceed the bin-table length or whose grpprl offsets fall outside the property block; the trade-off is conversion-fidelity differences and added pipeline complexity. Where antiword must remain in use, run it as an unprivileged, sandboxed process with a strict memory limit (ulimit -v or a container memory cap) so that the out-of-bounds read and resulting abort cannot escalate beyond a killed worker, accept that this converts a parser crash into a graceful job failure, and never place it on an automated path that ingests unauthenticated mail attachments or bulk-converted document sets. Build-time hardening such as -fstack-protector-strong and ASAN in staging will help detect the over-read during testing but does not remove the underlying missing bounds check, and applying it in production has a performance cost. Monitor the upstream antiword repository for a release that bounds run counts and grpprl offsets in vGet8PapInfo and vGet8ChrInfo, and note that the absence of patch data is not confirmation that no fix exists.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Antiword is a command-line converter that extracts text from legacy Microsoft Word binary (.doc) files. Word 8 documents store formatting properties in Formatted Disk Pages (FKP) - 512-byte structures that hold per-paragraph and per-character bin tables (PAPX/CHPX) plus a grpprl array of property modifiers referenced by offset, with run counts described by PLCF-style count arrays. The vulnerable routines vGet8PapInfo and vGet8ChrInfo in prop8.c trust the run counts and grpprl offsets read from the file without validating them against the bounds of the 512-byte buffer they were copied into, which is the classic CWE-125 out-of-bounds read pattern: an attacker-controlled length or index is used as-is rather than clamped to the destination allocation. Because the over-read is confined to the stack buffer and produces only a crash or garbled style parsing, the issue maps to a low-impact availability weakness rather than memory corruption that could be steered toward code execution. The affected component is identified by CPE cpe:2.3:a:adri_van_os:antiword:*:*:*:*:*:*:*:*, i.e. all releases of the Adri van Os Antiword package, including the current 0.37.
Know when Antiword gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Local vector (AV:L) since a victim must open a crafted file (UI:R); PR:N as no auth is needed; impact limited to availability (crash), with C:N/I:N matching the read-only OOB crash outcome.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded. Attackers can supply a crafted .doc file with malicious FKP pages to read past the 512-byte stack buffer, crashing antiword or corrupting style parsing.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Buffer overflow in the bGetPPS function in wordole.c in Antiword 0.37 allows remote attackers to cause a denial of servi
Parsing a crafted Word 8 (.doc) file with Antiword 0.37 and earlier can crash the process through a heap out-of-bounds r
Exploit-DB