CVE-2026-112056 in wv
Summary
by MITRE • 10/18/2026
wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by supplying crafted Word stylesheets. Attackers can provide a .doc file with ten or fewer styles or out-of-range style base indexes to read past heap arrays, crashing applications such as AbiWord.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified within wvWare versions up to 1.2.9 represents a critical memory safety flaw located in the stylesheet processing logic of the library. Specifically, the function wvGetSTSH in the file stylesheet.c is susceptible to a heap-based out-of-bounds read condition. This type of vulnerability arises when software reads data from a buffer at an offset that exceeds its allocated boundaries on the heap. In this specific instance, the flaw is triggered by malformed Microsoft Word documents that contain either ten or fewer styles or utilize style base indexes that fall outside the valid range defined by the document structure. When wvWare processes these crafted files, it fails to adequately validate the index values before attempting to access corresponding data structures in memory.
From a technical perspective, this flaw allows an attacker who can supply a malicious .doc file to cause the application consuming wvWare to read past the end of heap-allocated arrays. The immediate operational impact is typically a denial of service manifested as a crash or segmentation fault within applications that rely on wvWare for document parsing, such as AbiWord. While out-of-bounds reads are primarily associated with information disclosure if sensitive data resides in adjacent memory regions, in the context of this specific implementation and typical usage patterns, the primary consequence observed is application instability and termination. The lack of proper bounds checking means that invalid indices lead to undefined behavior, which most commonly results in immediate program failure rather than silent corruption or remote code execution in this particular scenario.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-125, Out-of-bounds Read, and can also be associated with CWE-20, Improper Input Validation, as the root cause is the failure to sanitize and validate user-supplied input data before processing. In terms of adversary tactics, this flaw could potentially be leveraged within an ATT&CK framework context under techniques related to Initial Access or Execution if combined with other vectors, though its primary utility here lies in causing service disruption through denial-of-service attacks against systems relying on the affected library for document conversion or viewing tasks.
Mitigation strategies should focus primarily on updating wvWare to a version where this issue has been resolved by developers who have implemented strict bounds checking within the wvGetSTSH function. For organizations unable to immediately patch, deploying input validation filters at the network perimeter or application gateway level can help block requests containing malformed .doc files with suspicious style index structures before they reach the vulnerable library. Additionally, enabling memory protection mechanisms such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) on systems running affected software can mitigate the risk of exploitation leading to more severe outcomes like code execution, although these controls do not prevent the initial crash caused by the out-of-bounds read itself.