CVE-2026-111677 in Antiword
Summary
by MITRE • 10/16/2026
Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF records in a tiny buffer, causing reads past the heap allocation that crash the process.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in Antiword versions through 0.37 represents a critical memory safety flaw located within the prop8.c source file, specifically inside the vGet8LstInfo function. This component is responsible for parsing property sets and list records from Microsoft Word 97-2003 binary format files, commonly known as .doc files. The core technical defect stems from an inverted bounds check logic error when processing the PlcfLst record count field. In a correctly implemented security control, a validation routine should ensure that the declared number of items in a list does not exceed the actual size of the allocated buffer to prevent memory corruption or unauthorized data access. However, due to this logical inversion, the application fails to properly verify whether the requested record count is within safe limits relative to the available heap space.
When an attacker supplies a specially crafted Word 8 document that claims to contain up to sixty-five thousand five hundred thirty-five LSTF records while providing only a minimal buffer allocation, the parsing routine proceeds without triggering the expected error conditions. Because the bounds check is inverted, the application interprets this mismatch as valid or fails to reject it appropriately. Consequently, during the execution of vGet8LstInfo, the software attempts to read data from memory addresses that lie beyond the boundaries of the allocated heap region. This results in a heap out-of-bounds read vulnerability, where sensitive information residing adjacent to the buffer may be exposed, or more commonly, invalid memory access occurs.
The operational impact of this flaw is primarily characterized by application instability and denial of service conditions. Since reading from unmapped or protected memory segments typically triggers segmentation faults on most operating systems, the immediate result for a user opening such a malicious document is the abrupt termination of the Antiword process. While heap out-of-bounds reads are sometimes associated with information disclosure vulnerabilities that could lead to remote code execution if combined with other primitives like use-after-free scenarios, in this specific context involving Antiword's parsing logic, the primary observable effect is a crash. This makes it particularly useful for attackers seeking to disrupt services or cause denial of service against systems relying on automated document processing pipelines using vulnerable versions of Antiword.
From a classification perspective, this vulnerability aligns with CWE-125, which describes Out-of-bounds Read vulnerabilities where software reads data past the end, or before the beginning, of the intended buffer. It also relates to CWE-697, Incorrect Comparison, as the root cause is the flawed logic in comparing the record count against the buffer size. In terms of attack vectors and tactics, this flaw can be exploited via ATT&CK technique T1203, Exploitation for Client Side Execution, where an attacker delivers a malicious document to trigger the vulnerability on the victim's machine. The exploitation typically requires social engineering or automated delivery mechanisms to get the user to open the crafted file within the vulnerable application context.
Mitigation strategies for this vulnerability are straightforward and center around software updates. Users running Antiword versions prior to 0.38 should upgrade immediately, as later revisions have corrected the bounds checking logic in prop8.c. For organizations that cannot update due to legacy system constraints or dependency issues, input validation at a higher level is recommended. This involves implementing strict size limits on parsed records before passing them down to the vulnerable parsing functions. Additionally, deploying sandboxing solutions can help contain potential crashes and prevent any secondary exploitation attempts by isolating the document processing tasks from critical system resources. Regular patch management remains the most effective defense against such memory corruption vulnerabilities in legacy open-source tools.