CVE-2026-112056 Details
Description
wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by supplying crafted Word stylesheets. Attackers can provide a .doc file with ten or fewer styles or out-of-range style base indexes to read past heap arrays, crashing applications such as AbiWord.
A heap-based out-of-bounds read vulnerability has been identified in wvWare wv versions through 1.2.9. The issue arises in the function wvGetSTSH within stylesheet.c, where the style count is trusted without validation. This vulnerability allows attackers to craft Word documents that, when processed by wvWare, can read past allocated heap arrays and potentially crash the application. The vulnerability can be exploited by providing a .doc file with ten or fewer styles or by using out-of-range style base indexes.
Users can upgrade to wv versions after 1.2.9, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/AbiWord/wv/blob/wv-1-2-9/stylesheet.c#L447 | [email protected] | Source CodeVendor |
| https://hackmd.io/@haindpwn/wv-fkp-crun-stsh-cstd-oob-read | [email protected] | BundleExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/wvware-wv-through-1.2.9-heap-out-of-bounds-read-via-wvgetstsh | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wvWare wv | <= 1.2.9 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |