{"id":"CVE-2026-111677","title":"antiword: antiword: Denial of Service via heap out-of-bounds read (CVE-2026-111677)","summary":"A flaw was found in Antiword. An attacker could exploit this vulnerability by enticing a user to open a specially crafted Word document. Due to an incorrect bounds check when parsing list records, processing the file triggers an out-of-bou…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-125"],"vendor":"Red Hat","product":"antiword","affected":["antiword <= 0.37"],"published":"2026-10-16","updated":"2026-10-21","sourceUpdated":"2026-10-21T09:34:49+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111677.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111677.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-111677"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-111677"},{"url":"https://hackmd.io/@haindpwn/antiword-word8-plcflst-count-and-fkp-run-oob-read"},{"url":"https://github.com/rsdoiel/antiword/blob/fe4b579067122a2d9d62647efb1ee7cfe3ca92bb/prop8.c#L799-L825"},{"url":"https://www.vulncheck.com/advisories/antiword-through-0.37-heap-out-of-bounds-read-via-vget8lstinfo-in-prop8-c","label":"VulnCheck Advisory: Antiword through 0.37 Heap Out-of-Bounds Read via vGet8LstInfo in prop8.c"}],"tags":["csaf","vex","red-hat","cve.org","exploit-available"],"epss":0.00187,"epssPercentile":0.08251,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T18:30:26.760021Z"},"ingestedAt":"2026-10-16T18:43:08.621Z","slug":"CVE-2026-111677","body":"## Overview\n\nA flaw was found in Antiword. An attacker could exploit this vulnerability by enticing a user to open a specially crafted Word document. Due to an incorrect bounds check when parsing list records, processing the file triggers an out-of-bounds read from memory, causing the application to crash and resulting in a Denial of Service (DoS).\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111677.json)\n\n**antiword: antiword: Denial of Service via heap out-of-bounds read**. Released 2026-10-16, updated 2026-10-21.\n\nNot affected:\n\n- All currently supported Red Hat products\n\n## Remediation\n\nRefer to the advisory for fix availability.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}