CVE-2026-112055

wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPXFKP and wvGetCHPXFKP caused by an unvalidated FKP run count. Attackers can supply a crafted .doc file with a large crun value to read kilobytes past the 512-byte stack buffer, crashing applications like...

CVE-2026-112055 wvWare wv through 1.2.9 Stack Out-of-Bounds Read via wvGetPAPX_FKP and wvGetCHPX_FKP

wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPXFKP and wvGetCHPXFKP caused by an unvalidated FKP run count. Attackers can supply a crafted .doc file with a large crun value to read kilobytes past the 512-byte stack buffer, crashing applications like...

CVE-2026-112055

The wvWare wv library through version 1.2.9 contains a stack-based out-of-bounds read vulnerability in the wvGetPAPX_FKP and wvGetCHPX_FKP functions. The root cause is an unvalidated FKP run count , which allows an attacker to supply a crafted .doc file containing a large crun value. This can cau...

EUVD-2026-103517

wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPXFKP and wvGetCHPXFKP caused by an unvalidated FKP run count. Attackers can supply a crafted .doc file with a large crun value to read kilobytes past the 512-byte stack buffer, crashing applications like...

CVE-2026-112055 wvWare wv through 1.2.9 Stack Out-of-Bounds Read via wvGetPAPX_FKP and wvGetCHPX_FKP

wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPXFKP and wvGetCHPXFKP caused by an unvalidated FKP run count. Attackers can supply a crafted .doc file with a large crun value to read kilobytes past the 512-byte stack buffer, crashing applications like...