wvWare CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM wvWare CVE published 2026-10-18

CVE-2026-112056

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-10-18T13:16:37.890Z and has not been modified since then. The vulnerability affects wvWare wv library, potentially causing application crashes or instability when processing crafted Word stylesheets. Defenders should verify affected versions, apply patches, and monitor for potential impacts on document [truncated]

MEDIUM wvWare CVE published 2026-10-18

CVE-2026-112055

A stack-based out-of-bounds read vulnerability exists in wvWare wv through 1.2.9, specifically in the functions wvGetPAPX_FKP and wvGetCHPX_FKP. This vulnerability is caused by an unvalidated FKP run count, allowing attackers to supply a crafted .doc file with a large crun value. This can lead to reading kilobytes past the 512-byte stack buffer, potentially crashing applications like AbiWord.