---
id: CVE-2026-111678
title: Antiword through 0.37 Stack Out-of-Bounds Read via prop8.c FKP Parsing
summary: >-
  Antiword through 0.37 contains a stack out-of-bounds read vulnerability in
  vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl
  offsets are not bounded. Attackers can supply a crafted .doc file with
  malicious FKP pa…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-125
vendor: Adri van Os
product: antiword
affected:
  - antiword <= 0.37
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T17:39:37.367Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111678'
references:
  - url: >-
      https://hackmd.io/@haindpwn/antiword-word8-plcflst-count-and-fkp-run-oob-read
  - url: >-
      https://github.com/rsdoiel/antiword/blob/fe4b579067122a2d9d62647efb1ee7cfe3ca92bb/prop8.c#L997-L1022
  - url: >-
      https://github.com/rsdoiel/antiword/blob/fe4b579067122a2d9d62647efb1ee7cfe3ca92bb/prop8.c#L1461-L1474
  - url: >-
      https://www.vulncheck.com/advisories/antiword-through-0.37-stack-out-of-bounds-read-via-prop8-c-fkp-parsing
    label: >-
      VulnCheck Advisory: Antiword through 0.37 Stack Out-of-Bounds Read via
      prop8.c FKP Parsing
tags:
  - cve.org
ingestedAt: '2026-10-16T18:43:08.664Z'
---

## Overview

Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded. Attackers can supply a crafted .doc file with malicious FKP pages to read past the 512-byte stack buffer, crashing antiword or corrupting style parsing.

## Affected

- `antiword <= 0.37`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.