CVE-2026-111677: 
NixOS vulnerability analysis and mitigation

CVE-2026-111677 is a heap out-of-bounds read vulnerability in Antiword through version 0.37, affecting the vGet8LstInfo function in prop8.c. The flaw is caused by an inverted bounds check on the PlcfLst record count when parsing Word 8 .doc files, allowing a crafted document to claim up to 0xffff LSTF records in a tiny buffer and trigger reads past the heap allocation. The vulnerability was published on October 16, 2026, and affects all Antiword releases up to and including 0.37. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 6.8 (Medium) (GitHub Advisory, VulnCheck).

The root cause is classified as CWE-125 (Out-of-bounds Read). In vGet8LstInfo (prop8.c, lines 799–825), the code reads the LSTF record count from the first two bytes of the aucLstfInfo buffer and then checks if (2 + tLstfRecords * 28 < tLstfInfoLen) — a condition that is inverted relative to the intended safety check. A malicious .doc file can embed a PlcfLst header claiming up to 0xffff LSTF records while providing only a small buffer, causing the subsequent loop to read far beyond the allocated heap region. Exploitation requires user interaction: a local user must open the crafted .doc file with Antiword. A technical write-up with source code excerpts is publicly available (HackMD Write-up, GitHub Source).

Successful exploitation causes the Antiword process to crash, resulting in a denial of service. There is no impact on confidentiality or integrity, as the vulnerability only affects availability of the Antiword process itself. The scope is limited to the local system where the crafted .doc file is processed; no lateral movement or data exfiltration has been identified as a consequence of this vulnerability (GitHub Advisory, VulnCheck).

A technical write-up describing the vulnerability with source code excerpts is publicly available, but no functional exploit code, crafted .doc file, or step-by-step reproduction instructions have been published (HackMD Write-up). NVD SSVC classifies exploitation status as "poc" (proof-of-concept level), with automatable exploitation assessed as "no" due to the required user interaction. The EPSS score is 0.0, indicating very low probability of exploitation in the wild, and there is no evidence of in-the-wild exploitation or CISA KEV catalog inclusion (GitHub Advisory).

1. Craft a malicious .doc file: Create a Word 8 format .doc file with a PlcfLst (List data on File) structure whose first two bytes encode a large LSTF record count (e.g., 0xffff), while the actual buffer allocated for the structure is much smaller than 2 + 0xffff * 28 bytes.
2. Deliver the file to the target: Social-engineer a local user into receiving the crafted .doc file via email attachment, file share, or download.
3. Trigger processing: Convince the user to process the file with Antiword (e.g., antiword malicious.doc), which invokes vGet8LstInfo in prop8.c.
4. Trigger the out-of-bounds read: The inverted bounds check (if (2 + tLstfRecords * 28 < tLstfInfoLen)) fails to catch the oversized record count, and the subsequent loop iterates over memory beyond the heap allocation.
5. Achieve denial of service: The process reads past the heap buffer boundary, causing a crash (segmentation fault or similar) and terminating the Antiword process (HackMD Write-up, GitHub Source).

• Process: Antiword process terminating unexpectedly with a segmentation fault or similar crash signal when processing a .doc file; crash dumps or core files generated by the Antiword process.
• Logs: System logs (e.g., /var/log/syslog, /var/log/kern.log) recording segfault events attributed to the antiword process; application error output referencing prop8.c or list parsing.
• File System: Presence of unexpected or suspicious .doc files in user download directories or temporary folders, particularly those with anomalously small file sizes but large claimed record counts in their PlcfLst structures.

Update Antiword to a version newer than 0.37 once a patched release is available; a patch has been referenced in the GitHub Advisory (GHSA-v4mq-qwjh-99x8) as of October 16, 2026. Until a fixed version is available, avoid processing .doc files from untrusted sources with Antiword. If Antiword is deployed in a pipeline that accepts user-supplied documents, implement file type validation and sandboxing to limit the impact of a crash (GitHub Advisory, VulnCheck).