{"id":"CVE-2026-112055","kind":"vulnerability","aliases":["CVE-2026-112055"],"related":[],"title":"wvWare wv: crafted .doc file reads past stack buffer","description":"wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPX_FKP and wvGetCHPX_FKP caused by an unvalidated FKP run count. Attackers can supply a crafted .doc file with a large crun value to read kilobytes past the 512-byte stack buffer, crashing applications like AbiWord.","summary":"wvWare's wv library, through version 1.2.9, miscalculates a run count in Word binary FKP data, so wvGetPAPX_FKP and wvGetCHPX_FKP read kilobytes beyond a 512-byte stack buffer. An attacker who supplies a crafted .doc file can crash applications that parse it, such as AbiWord.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["abiword","document-conversion","linux-desktop","package","wvware"],"not_affected_if":["no-doc-parsing","no-untrusted-documents"],"how_to_check":"- Check whether the application links against wv (wvWare) with `ldd` or the package manager, for example `dpkg -l | grep wv` or `rpm -q wv`\n- Check the installed wv version with `wvWare --version` or the package manager, versions up to `1.2.9` are affected\n- Check whether the application opens untrusted .doc files through wvWare","fix":null,"status":"open","published_at":"2026-10-18T13:16:37+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T03:44:59+00:00","updated_at":"2026-10-25T03:44:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:44:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"wvWare wv: crafted .doc file reads past stack buffer","impact":"low","summary":"wvWare's wv library, through version 1.2.9, miscalculates a run count in Word binary FKP data, so wvGetPAPX_FKP and wvGetCHPX_FKP read kilobytes beyond a 512-byte stack buffer. An attacker who supplies a crafted .doc file can crash applications that parse it, such as AbiWord.","category":"package","nicknames":[],"who_cares":["wvware","abiword","linux-desktop","document-conversion"],"confidence":0.6,"needs_auth":"no","worst_case":"Application crashes while parsing a crafted document; information past the buffer may leak.","analyst_note":"Find a fixed wv version or upstream commit and confirm the affected version range beyond 'through 1.2.9'; check whether an out-of-bounds read here leaks data or only crashes.","how_to_check":"- Check whether the application links against wv (wvWare) with `ldd` or the package manager, for example `dpkg -l | grep wv` or `rpm -q wv`\n- Check the installed wv version with `wvWare --version` or the package manager, versions up to `1.2.9` are affected\n- Check whether the application opens untrusted .doc files through wvWare","needs_analyst":true,"not_affected_if":["no-doc-parsing","no-untrusted-documents"],"who_is_affected":"Applications that use wvWare's wv library to parse Word 97 .doc files, including AbiWord, are exposed when they open documents from untrusted sources. Systems that never convert or open .doc files with wv can skip it. The sources do not say which fixed version exists.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00065,"input_tokens":3369,"output_tokens":626,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112055':12A,15A '-2026':11A,14A '1.2.9':31B,75C '512':51B,117C 'abiword':16B,71B,124C 'applic':65B,122C 'attack':56B,100C 'base':80C 'beyond':49B 'binari':38B 'bound':84C 'buffer':9A,54B,120C 'byte':52B,118C 'caus':93C 'contain':76C 'convers':19B 'count':35B,99C 'craft':3A,60B,104C 'crash':64B,121C 'crun':110C 'cve':10A,13A 'data':40B 'desktop':22B 'doc':4A,61B,105C 'document':18B 'document-convers':17B 'file':5A,62B,106C 'fkp':39B,43B,46B,89C,92C,97C 'kilobyt':48B,114C 'larg':109C 'librari':28B 'like':123C 'linux':21B 'linux-desktop':20B 'miscalcul':32B 'out-of-bound':81C 'packag':23B 'pars':67B 'past':7A,115C 'read':6A,47B,85C,113C 'run':34B,98C 'stack':8A,53B,79C,119C 'stack-bas':78C 'suppli':58B,102C 'unvalid':96C 'valu':111C 'version':30B 'vulner':86C 'word':37B 'wv':2A,27B,73C 'wvgetchpx':45B,91C 'wvgetpapx':42B,88C 'wvware':1A,24B,25B,72C","nicknames":[],"mitigations":[],"who_affected":"Applications that use wvWare's wv library to parse Word 97 .doc files, including AbiWord, are exposed when they open documents from untrusted sources. Systems that never convert or open .doc files with wv can skip it. The sources do not say which fixed version exists.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T13:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112055","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112055","severity":null,"published_at":"2026-10-18T13:16:37+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}