{"id":"CVE-2026-111677","kind":"vulnerability","aliases":["CVE-2026-111677"],"related":[],"title":"Antiword: crafted .doc file causes heap out-of-bounds read and crash","description":"Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF records in a tiny buffer, causing reads past the heap allocation that crash the process.","summary":"Antiword through 0.37 has an inverted bounds check in vGet8LstInfo (prop8.c) when reading the PlcfLst record count. A crafted Word 8 .doc file can make it read past a heap allocation, which crashes the process.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"antiword project antiword","fixed":[],"affected":"<= 0.37","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["antiword","document-processing","package","self-hosted"],"not_affected_if":["no-untrusted-doc-input"],"how_to_check":"- Run `antiword -v` or check the installed package version; affected if it is `0.37` or earlier\n- Find where antiword processes untrusted .doc uploads or files from external sources","fix":null,"status":"open","published_at":"2026-10-16T18:17:50+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:45:10+00:00","updated_at":"2026-10-25T03:45:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:45:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Antiword: crafted .doc file causes heap out-of-bounds read and crash","impact":"low","summary":"Antiword through 0.37 has an inverted bounds check in vGet8LstInfo (prop8.c) when reading the PlcfLst record count. A crafted Word 8 .doc file can make it read past a heap allocation, which crashes the process.","category":"package","nicknames":[],"who_cares":["antiword","document-processing","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Process crashes when a crafted .doc file is parsed","analyst_note":"Check the NVD entry and the upstream antiword project for a fixed version and whether a patch exists beyond 0.37.","how_to_check":"- Run `antiword -v` or check the installed package version; affected if it is `0.37` or earlier\n- Find where antiword processes untrusted .doc uploads or files from external sources","needs_analyst":true,"not_affected_if":["no-untrusted-doc-input"],"who_is_affected":"Teams that run antiword on .doc files from users or external sources, for example in document conversion or indexing pipelines. Systems that never parse untrusted Word files can skip it. The description reports a crash; it does not claim code execution.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000579,"input_tokens":3388,"output_tokens":481,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111677':16A,19A '-2026':15A,18A '0.37':33B,68C '0xffff':105C '8':51B,99C 'alloc':61B,117C 'antiword':1A,20A,22A,23B,31B,66C 'attack':93C 'bound':10A,37B,75C,86C 'buffer':111C 'caus':5A,82C,112C 'check':38B,87C 'claim':102C 'contain':69C 'count':47B,92C 'craft':2A,49B,97C 'crash':13A,63B,119C 'cve':14A,17A 'doc':3A,52B,100C 'document':25B 'document-process':24B 'file':4A,53B,101C 'heap':6A,60B,71C,116C 'host':30B 'invert':36B,85C 'lstf':106C 'make':55B 'out-of-bound':7A,72C 'packag':27B 'past':58B,114C 'plcflst':45B,90C 'process':26B,65B,121C 'project':21A 'prop8.c':41B,81C 'read':11A,43B,57B,76C,113C 'record':46B,91C,107C 'self':29B 'self-host':28B 'suppli':95C 'tini':110C 'vget8lstinfo':40B,79C 'vulner':77C 'word':50B,98C","nicknames":[],"mitigations":[],"who_affected":"Teams that run antiword on .doc files from users or external sources, for example in document conversion or indexing pipelines. Systems that never parse untrusted Word files can skip it. The description reports a crash; it does not claim code execution.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111677","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111677","severity":null,"published_at":"2026-10-16T18:17:50+00:00","modified_at":"2026-10-20T19:08:12+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}