Read the docs
TI-2026-76714 Aliases CVE-2026-109831GHSA-q9jg-8mw4-m3mw

Out-of-bounds write in GNU UnRTF allows denial of service

Priority LOW 23CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

GNU Project UnRTF before 0.21.12 contains an out-of-bounds write (CWE-787). If a user opens an RTF file crafted by an attacker, the flaw can cause a denial-of-service condition.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may lead to a denial-of-service (DoS) condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00207 10th percentileScored 2026-11-07
Fix Fixed UnRTF (GNU Project): 0.21.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GNUUnRTFbefore 0.21.120.21.12Patch availableCNA
  • UnRTF VendorGNU Affected before 0.21.12 Fixed in 0.21.12 Patch available CNA

Remediation

UnRTF 0.21.12 fixes this flaw. Users of earlier versions should update UnRTF to 0.21.12.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA UnRTF (GNU Project) Fixed in 0.21.12

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-109831
  2. 2026-10-20 Alias added: GHSA-q9jg-8mw4-m3mw
  3. 2026-10-20 CISA SSVC decision points changed
  4. 2026-10-21 Affected versions changed · Red Hat
  5. 2026-10-21 CVSS score added · Red Hat

References

Other 2

  • TI-2026-19388 telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root"… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05164 GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the… KEVCVSS 3.1HIGH 8.8
  • TI-2023-04522 Glibc: buffer overflow in ld.so leading to privilege escalation KEVCVSS 3.1HIGH 7.8
  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
See all 1272 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences