Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF records in a tiny buffer, causing reads past the heap allocation that crash the process.
References
| Link | Resource |
|---|---|
| https://github.com/rsdoiel/antiword/blob/fe4b579067122a2d9d62647efb1ee7cfe3ca92bb/prop8.c#L799-L825 | Product |
| https://hackmd.io/@haindpwn/antiword-word8-plcflst-count-and-fkp-run-oob-read | Exploit Mitigation Third Party Advisory |
| https://www.vulncheck.com/advisories/antiword-through-0.37-heap-out-of-bounds-read-via-vget8lstinfo-in-prop8-c | Third Party Advisory |
| https://hackmd.io/@haindpwn/antiword-word8-plcflst-count-and-fkp-run-oob-read | Exploit Mitigation Third Party Advisory |
Configurations
History
20 Oct 2026, 19:08
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Antiword Project
Antiword Project antiword |
|
| CPE | cpe:2.3:a:antiword_project:antiword:*:*:*:*:*:*:*:* | |
| References | () https://github.com/rsdoiel/antiword/blob/fe4b579067122a2d9d62647efb1ee7cfe3ca92bb/prop8.c#L799-L825 - Product | |
| References | () https://hackmd.io/@haindpwn/antiword-word8-plcflst-count-and-fkp-run-oob-read - Exploit, Mitigation, Third Party Advisory | |
| References | () https://www.vulncheck.com/advisories/antiword-through-0.37-heap-out-of-bounds-read-via-vget8lstinfo-in-prop8-c - Third Party Advisory |
16 Oct 2026, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://hackmd.io/@haindpwn/antiword-word8-plcflst-count-and-fkp-run-oob-read - |
16 Oct 2026, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-16 18:17
Updated : 2026-10-20 19:08
NVD link : CVE-2026-111677
Mitre link : CVE-2026-111677
CVE.ORG link : CVE-2026-111677
JSON object : View
Products Affected
antiword_project
- antiword
CWE
CWE-125
Out-of-bounds Read