---
id: CVE-2026-109831
title: UnRTF by GNU Project is vulnerable to out-of-bounds write
summary: >-
  UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an
  RTF file crafted by an attacker, it may lead to a denial-of-service (DoS)
  condition.
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-787
vendor: GNU Project
product: UnRTF
affected:
  - UnRTF < 0.21.12
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T04:34:19.617Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-109831'
references:
  - url: 'https://savannah.gnu.org/news/?id=10925'
  - url: 'https://jvn.jp/en/jp/JVN29783594/'
tags:
  - cve.org
ingestedAt: '2026-10-20T04:52:44.231Z'
---

## Overview

UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may lead to a denial-of-service (DoS) condition.

## Affected

- `UnRTF < 0.21.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.