Read the docs
TI-2026-76184 Aliases CVE-2026-112056GHSA-jhv8-9974-jvpp

Heap out-of-bounds read in wvWare wv lets crafted files crash apps

Priority LOW 29CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

wvWare wv through 1.2.9 contains a heap out-of-bounds read in the wvGetSTSH function in stylesheet.c, classified as CWE-125. A crafted .doc file with ten or fewer styles or out-of-range style base indexes makes the read go past heap arrays. An attacker can supply such a file to crash applications such as AbiWord.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by supplying crafted Word stylesheets. Attackers can provide a .doc file with ten or fewer styles or out-of-range style base indexes to read past heap arrays, crashing applications such as AbiWord.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00118 1st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wvWarewvup to 1.2.9—No fix listedCNA
  • wv VendorwvWare Affected up to 1.2.9 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for wvWare wv.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-18 Threatist record created from CVE-2026-112056
  2. 2026-10-18 Alias added: GHSA-jhv8-9974-jvpp
  3. 2026-10-19 CISA SSVC decision points changed
  4. 2026-10-19 Priority changed: MEDIUM → LOW
  5. 2026-10-22 Affected versions changed · Red Hat
  6. 2026-10-22 CVSS score added · Red Hat

References

Advisory 1

Other 1

  • TI-2026-76183 Stack out-of-bounds read in wvWare wv document parsing CVSS 4.0MEDIUM 6.8
  • TI-2004-00586 Buffer overflow in the wvHandleDateTimePicture function in wv library (wvWare) 0.7.4… CVSS 2.0HIGH 10.0
  • TI-2006-03274 Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including… CVSS 2.0HIGH 7.5
  • TI-2015-03839 Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote… CVSS 2.0MEDIUM 6.8
  • TI-2015-00789 Heap-based buffer overflow in libwmf 0.2.8.4 allows remote attackers to cause a denial of… CVSS 2.0MEDIUM 6.8
  • TI-2006-02140 Integer overflow in wv2 before 0.2.3 might allow context-dependent attackers to execute… CVSS 2.0MEDIUM 6.5
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences