wvWare wv CVE-2026-112056

Exploitation requires the victim to open an attacker-supplied Microsoft Word .doc file in an application built on the wv library (version through 1.2.9), such as AbiWord. The specific trigger is a Word stylesheet that either declares ten or fewer styles or carries out-of-range style base indexes, causing wvGetSTSH in stylesheet.c to read past heap arrays. Limiting factors: the attack vector is local (AV:L) and demands user interaction (UI:P) - the file must be delivered and opened - so there is no remote unauthenticated path; the impact is confined to crashing the parsing application (availability only), with no code execution or data disclosure established in the available data.

This is a denial-of-service issue, not a high-priority remote threat. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) scores 6.8 (Medium) and is internally consistent with the description: exploitation requires a local attack vector (a malicious .doc must reach and be opened by the victim's application) with passive user interaction, and the only impact is availability (VA:H) - a crash - with no confidentiality or integrity impact (VC:N/VI:N). Despite the CWE-125 (out-of-bounds READ) classification and the 'Information Disclosure' tag, the CVSS confidentiality metric is N and the description states the read merely crashes the application, so there is no confirmed data-leak primitive. No EPSS score, no CISA KEV listing, and no confirmed proof-of-concept flag were provided in the input, so this is classified as no public exploit identified at time of analysis - though the referenced hackmd writeup and the direct link to the vulnerable stylesheet.c line suggest technical analysis is public. The signals are consistent and point to a low-real-risk, crash-only bug in a niche document-parsing library rather than a widely exploitable vulnerability. Missing data: EPSS probability and any vendor fix version are absent from the input.

An attacker crafts a malicious Microsoft Word .doc file whose stylesheet declares ten or fewer styles or contains out-of-range style base indexes, then delivers it to a victim (email attachment, download, shared drive). When the victim opens the file in an application that uses the wv library - such as AbiWord - wvGetSTSH reads past the end of a heap array and the application crashes. Public technical analysis of the flaw exists in the referenced writeup, but no confirmed weaponized exploit was indicated in the input.