{"id":"CVE-2026-109831","kind":"vulnerability","aliases":["CVE-2026-109831"],"related":[],"title":"UnRTF: out-of-bounds write lets a crafted RTF file crash it","description":"UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may lead to a denial-of-service (DoS) condition.","summary":"UnRTF, the GNU RTF-to-text converter, has an out-of-bounds write triggered when it parses an attacker-crafted RTF file. The sources say a user opening such a file may hit a denial-of-service condition.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["document-conversion","linux","package","unrtf"],"not_affected_if":["no-untrusted-rtf"],"how_to_check":"- Run `unrtf --version` to see the installed version; the sources do not name the affected range.\n- Check whether any pipeline or service converts untrusted RTF files with unrtf.","fix":null,"status":"open","published_at":"2026-10-20T05:16:53+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:16:38+00:00","updated_at":"2026-10-25T04:16:38+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:16:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"UnRTF: out-of-bounds write lets a crafted RTF file crash it","impact":"low","summary":"UnRTF, the GNU RTF-to-text converter, has an out-of-bounds write triggered when it parses an attacker-crafted RTF file. The sources say a user opening such a file may hit a denial-of-service condition.","category":"package","nicknames":[],"who_cares":["unrtf","document-conversion","linux"],"confidence":0.5,"needs_auth":"no","worst_case":"Converter crashes; denial of service on the file-processing host","analyst_note":"Find the affected version range and the patched UnRTF release in the NVD entry or the GNU project release notes.","how_to_check":"- Run `unrtf --version` to see the installed version; the sources do not name the affected range.\n- Check whether any pipeline or service converts untrusted RTF files with unrtf.","needs_analyst":true,"not_affected_if":["no-untrusted-rtf"],"who_is_affected":"Systems that run UnRTF on RTF files from outside sources, such as mail gateways, document previewers or upload handlers. Teams that never convert untrusted RTF can skip it. The sources do not name affected versions or a patched release.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000562,"input_tokens":3272,"output_tokens":470,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109831':15A,18A '-2026':14A,17A 'attack':46B,89C 'attacker-craft':45B 'bound':5A,38B,77C 'condit':66B,100C 'convers':21B 'convert':32B 'craft':9A,47B,86C 'crash':12A 'cve':13A,16A 'denial':63B,96C 'denial-of-servic':62B,95C 'document':20B 'document-convers':19B 'dos':99C 'file':11A,49B,58B,85C 'gnu':27B,69C 'hit':60B 'lead':92C 'let':7A 'linux':22B 'may':59B,91C 'open':55B,82C 'out-of-bound':2A,35B,74C 'packag':23B 'pars':43B 'project':70C 'rtf':10A,29B,48B,84C 'rtf-to-text':28B 'say':52B 'servic':65B,98C 'sourc':51B 'text':31B 'trigger':40B 'unrtf':1A,24B,25B,67C 'user':54B,81C 'vulner':72C 'write':6A,39B,78C","nicknames":[],"mitigations":[],"who_affected":"Systems that run UnRTF on RTF files from outside sources, such as mail gateways, document previewers or upload handlers. Teams that never convert untrusted RTF can skip it. The sources do not name affected versions or a patched release.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T05:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vultures@jpcert.or.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109831","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109831","severity":null,"published_at":"2026-10-20T05:16:53+00:00","modified_at":"2026-10-20T20:17:14+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}