TI-2018-02950 Aliases CVE-2018-3982 GHSA-fvcx-pr44-cwwj

Out-of-bounds write in Atlantis Word Processor

LOW 37CWE-787Published 2018-10-01 · Updated 2024-09-17

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

An exploitable arbitrary write vulnerability exists in the Word document parser of the Atlantis Word Processor 3.0.2.3 and 3.0.2.5. A specially crafted document can prevent Atlas from adding elements to an array that is indexed by a loop. When reading from this array, the application will use an out-of-bounds index which can result in arbitrary data being read as a pointer. Later, when the application attempts to write to said pointer, an arbitrary write will occur. This can allow an attacker to further corrupt memory, which leads to code execution under the context of the application. An attacker must convince a victim to open a document in order to trigger this vulnerability.

Why it matters now

EPSS 0.0128 70th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
The Atlantis Word Processor Team	Atlantis Word Processor	3.0.2.3, 3.0.2.5	—	No fix listed	CNA

Atlantis Word Processor VendorThe Atlantis Word Processor Team Affected 3.0.2.3, 3.0.2.5 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:atlantiswordprocessor:atlantis_word_processor:3.0.2.3:::::::*	3.0.2.3	Vulnerable	The Atlantis Word Processor Team
cpe:2.3:a:atlantiswordprocessor:atlantis_word_processor:3.0.2.5:::::::*	3.0.2.5	Vulnerable	The Atlantis Word Processor Team

cpe:2.3:a:atlantiswordprocessor:atlantis_word_processor:3.0.2.3:*:*:*:*:*:*:* Versions 3.0.2.3 Vulnerable ·The Atlantis Word Processor Team
cpe:2.3:a:atlantiswordprocessor:atlantis_word_processor:3.0.2.5:*:*:*:*:*:*:* Versions 3.0.2.5 Vulnerable ·The Atlantis Word Processor Team

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2018-3982
2026-10-03 Alias added: GHSA-fvcx-pr44-cwwj

References

Exploit 1

https://talosintelligence.com/vulnerability_reports/TALOS-2018-0650

TI-2018-02946 Out-of-bounds write in Atlantis Word Processor CVSS 3.0HIGH 8.8
TI-2018-03007 Out-of-bounds write in Talos Atlantis Word Processor CVSS 3.1HIGH 7.8
TI-2018-03006 An exploitable arbitrary write vulnerability exists in the open document format parser of… CVSS 3.1HIGH 7.8
TI-2018-02969 An exploitable uninitialized pointer vulnerability exists in the Office Open XML parser… CVSS 3.1HIGH 7.8
TI-2018-02952 Memory corruption in Atlantis Word Processor CVSS 3.1HIGH 7.8
TI-2018-02951 An exploitable uninitialized pointer vulnerability exists in the Word document parser of… CVSS 3.1HIGH 7.8

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences