CVE-2026-112056: wvWare wv through 1.2.9 Heap Out-of-Bounds Read via wvGetSTSH
wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by supplying crafted Word stylesheets. Attackers can provide a .doc file with ten or fewer styles or out-of-range style base indexes to read past heap arrays, crashing applications such as AbiWord.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to trigger the issue?
An attacker must supply a crafted Word .doc file containing a stylesheet with ten or fewer styles or out-of-range style base indexes. User interaction is required because a vulnerable application must process the malicious document.
Who is exposed to this vulnerability?
Applications that use affected wvWare wv versions through 1.2.9 to parse Word documents are exposed. The reported impact is an application crash, with AbiWord identified as an example affected application.
How can I determine whether an application may be affected?
Check whether the application includes or relies on wvWare wv through version 1.2.9 and processes .doc files. Review whether it invokes the wvGetSTSH stylesheet parsing code in stylesheet.c when opening those documents.