CVE-2026-111677: Out-of-bounds Read in Adri van Os antiword

CVE-2026-111677 is a heap out-of-bounds read vulnerability in Antiword through version 0.37. The vulnerability exists in the vGet8LstInfo function in prop8.c, caused by an inverted bounds check on the PlcfLst record count. An attacker can craft a Word 8 .doc file that claims up to 0xffff LSTF records in a small buffer, causing the program to read past the heap allocation. This results in a crash of the Antiword process. The CVSS 4.0 score is 6.8, indicating medium severity. There is no indication of known exploits in the wild or vendor-provided patches.

The vulnerability allows an attacker to cause a denial of service by crashing the Antiword process through a crafted Word 8 .doc file. There is no evidence of privilege escalation, code execution, or data disclosure. The attack requires local access (AV:L) and user interaction (UI:P), with no privileges required (PR:N).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid opening untrusted Word 8 .doc files with affected versions of Antiword. Monitor vendor channels for updates or patches addressing this issue.