CVE-2026-111678: 
NixOS vulnerability analysis and mitigation

CVE-2026-111678 is a stack out-of-bounds read vulnerability in Antiword through version 0.37, affecting the vGet8PapInfo and vGet8ChrInfo functions in prop8.c. The flaw arises because FKP (Formatted disK Page) run counts and grpprl offsets are not properly bounded, allowing a crafted .doc file to cause reads past a 512-byte stack buffer. It was published on October 16, 2026, and assigned a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 4.8 (Medium) (Github Advisory, Feedly).

The root cause is classified as CWE-125 (Out-of-bounds Read). In prop8.c, the functions vGet8PapInfo (around lines 997–1022) and vGet8ChrInfo (around lines 1461–1474) iterate over FKP run entries and grpprl property records without validating that the run count or offset values remain within the bounds of the 512-byte stack-allocated buffer (aucFpage[BIG_BLOCK_SIZE]). An attacker can craft a .doc file with malicious FKP pages that supply out-of-range run counts or grpprl offsets, causing the parser to read beyond the buffer boundary. Exploitation requires local access and user interaction — specifically, a victim must open the malicious .doc file with Antiword (Github Advisory, prop8.c L997, prop8.c L1461).

Successful exploitation results in a denial of service via application crash or corruption of style parsing output, with low availability impact and no confidentiality or integrity impact on the vulnerable system. Because Antiword is a command-line document conversion utility often used in automated pipelines (e.g., email attachment processing, document indexing), a crash could disrupt batch processing workflows. There is no evidence of lateral movement potential or sensitive data exposure associated with this vulnerability (Github Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a victim to manually process a crafted .doc file, limiting the attack surface to scenarios where untrusted documents are parsed by Antiword.

1. Craft malicious .doc file: Create a Word 97–2003 binary .doc file with a malformed FKP (Formatted disK Page) structure. Set FKP run counts or grpprl property offsets to values that exceed the 512-byte stack buffer boundary in prop8.c.
2. Deliver the file: Deliver the crafted .doc file to a target system where Antiword is installed — for example, via email attachment, file share, or upload to a document processing service.
3. Trigger parsing: Induce the victim or an automated process to invoke Antiword on the malicious file (e.g., antiword malicious.doc). This triggers the vulnerable code paths in vGet8PapInfo or vGet8ChrInfo.
4. Achieve denial of service: The unbounded read past the 512-byte stack buffer causes Antiword to crash or produce corrupted style parsing output, disrupting any dependent document processing pipeline (Github Advisory, prop8.c L997).

• Process: Antiword process terminating abnormally (non-zero exit code, segmentation fault signal) when processing a .doc file.
• Logs: System logs (e.g., /var/log/syslog, dmesg) showing segfault or stack smashing errors attributed to the antiword process.
• File System: Presence of unexpected or externally sourced .doc files in directories monitored by automated Antiword-based pipelines (e.g., mail spool, document ingestion folders).
• Application Output: Garbled or truncated style/paragraph output from Antiword when processing a specific .doc file, indicating corrupted style parsing rather than a clean crash.

Update Antiword to a version newer than 0.37 once a patched release becomes available; a patch is referenced in the GitHub Advisory (Github Advisory). As interim mitigations, restrict Antiword to processing only .doc files from trusted sources, implement input validation or file screening to detect and reject malformed .doc files before they reach Antiword, and consider sandboxing document parsing operations (e.g., using containers or restricted user accounts) to limit the impact of a crash. Organizations using Antiword in automated pipelines should monitor for abnormal process terminations.