Stack-Based Out-of-Bounds Read in wvWare wv

Executive Summary

CVE-2026-112055 is a stack-based out-of-bounds read vulnerability in wvWare wv versions up to 1.2.9. It occurs in the functions wvGetPAPX_FKP and wvGetCHPX_FKP due to unvalidated FKP run counts. Attackers can craft a malicious .doc file with a large crun value, causing the application to read beyond a 512-byte stack buffer, leading to crashes in applications like AbiWord.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect systems running wvWare wv versions up to 1.2.9. Check for crashes in applications like AbiWord when processing .doc files. Monitor for stack-based out-of-bounds read errors in logs or during file parsing operations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause applications like AbiWord to crash when processing malicious .doc files. It may also lead to information disclosure if attackers exploit the out-of-bounds read to access sensitive memory. The impact depends on the privileges of the affected application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes application crashes due to out-of-bounds memory reads, which may lead to denial-of-service conditions. It does not directly expose or leak sensitive data, so its impact on compliance standards like GDPR or HIPAA is likely minimal unless combined with other exploits. However, crashes in document processing applications could disrupt workflows handling regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update wvWare wv to a patched version beyond 1.2.9. If updating is not possible, restrict access to applications using wvWare wv or block processing of .doc files from untrusted sources. Monitor vendor advisories for patches.

Useful 0 Not Useful 0