CVE-2026-112055: wvWare wv through 1.2.9 Stack Out-of-Bounds Read via wvGetPAPX_FKP and wvGetCHPX_FKP
wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPXFKP and wvGetCHPXFKP caused by an unvalidated FKP run count. Attackers can supply a crafted .doc file with a large crun value to read kilobytes past the 512-byte stack buffer, crashing applications like AbiWord.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications that use wvWare wv through 1.2.9 to process attacker-supplied .doc files may be exposed. AbiWord is specifically identified as an application that can crash.
What does an attacker need to exploit the vulnerability?
An attacker needs to provide a crafted .doc file containing a large FKP crun value and have a vulnerable application process that file. The supplied vector indicates local attack access and user interaction are required.
What is the likely impact of successful exploitation?
The documented impact is a crash caused by reading kilobytes beyond a 512-byte stack buffer, resulting in denial of service. No confidentiality or integrity impact is indicated by the provided severity vector.