---
id: CVE-2026-111677
title: >-
  antiword: antiword: Denial of Service via heap out-of-bounds read
  (CVE-2026-111677)
summary: >-
  A flaw was found in Antiword. An attacker could exploit this vulnerability by
  enticing a user to open a specially crafted Word document. Due to an incorrect
  bounds check when parsing list records, processing the file triggers an
  out-of-bou…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-125
vendor: Red Hat
product: antiword
affected:
  - antiword <= 0.37
published: '2026-10-16'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T09:34:49+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111677.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111677.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-111677'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-111677'
  - url: >-
      https://hackmd.io/@haindpwn/antiword-word8-plcflst-count-and-fkp-run-oob-read
  - url: >-
      https://github.com/rsdoiel/antiword/blob/fe4b579067122a2d9d62647efb1ee7cfe3ca92bb/prop8.c#L799-L825
  - url: >-
      https://www.vulncheck.com/advisories/antiword-through-0.37-heap-out-of-bounds-read-via-vget8lstinfo-in-prop8-c
    label: >-
      VulnCheck Advisory: Antiword through 0.37 Heap Out-of-Bounds Read via
      vGet8LstInfo in prop8.c
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
  - exploit-available
epss: 0.00187
epssPercentile: 0.08251
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T18:30:26.760021Z'
ingestedAt: '2026-10-16T18:43:08.621Z'
---

## Overview

A flaw was found in Antiword. An attacker could exploit this vulnerability by enticing a user to open a specially crafted Word document. Due to an incorrect bounds check when parsing list records, processing the file triggers an out-of-bounds read from memory, causing the application to crash and resulting in a Denial of Service (DoS).

## Vendor advisories

- **Red Hat VEX** · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-111677.json)

**antiword: antiword: Denial of Service via heap out-of-bounds read**. Released 2026-10-16, updated 2026-10-21.

Not affected:

- All currently supported Red Hat products

## Remediation

Refer to the advisory for fix availability.