Wvware vulnerabilities
11 vulnerabilities
Known vulnerabilities in Wvware products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 4 products.
Products
4RoutineCVE-2026-112056wvware · wv +2 morewvWare wv through 1.2.9 Heap Out-of-Bounds Read via wvGetSTSHwvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by supplying crafted Word stylesheets. Attackers can provide a .doc file with ten or fewer styles or out-of-range style base indexes to read past heap arrays, crashing applications such as AbiWord.CVSS6.8MediumEPSS0.12%RoutineCVE-2026-112055wvware · wv +2 morewvWare wv through 1.2.9 Stack Out-of-Bounds Read via wvGetPAPX_FKP and wvGetCHPX_FKPwvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPX_FKP and wvGetCHPX_FKP caused by an unvalidated FKP run count. Attackers can supply a crafted .doc file with a large crun value to read kilobytes past the 512-byte stack buffer, crashing applications like AbiWord.CVSS6.8MediumEPSS0.18%RoutineCVE-2016-9011wvware · libwmf +3 morewvware libwmfThe wmf_malloc function in api.c in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (application crash) via a crafted wmf file, which triggers a memory allocation failure.CVSS5.5MediumEPSS2.71%RoutineCVE-2015-4696wvware · libwmf +2 morewvware libwmfUse-after-free vulnerability in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) via a crafted WMF file to the (1) wmf2gd or (2) wmf2eps command.CVSS4.3MediumEPSS5.94%RoutineCVE-2015-4695wvware · libwmf +2 morewvware libwmfmeta.h in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WMF file.CVSS5.0MediumEPSS6.59%RoutineCVE-2015-4588fedoraproject · fedora +4 morefedoraproject fedoraHeap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted "run-length count" in an image in a WMF file.CVSS6.8MediumEPSS9.16%RoutineCVE-2015-0848fedoraproject · fedora +4 morefedoraproject fedoraHeap-based buffer overflow in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image.CVSS6.8MediumEPSS8.48%RoutineCVE-2006-4513wvware +2 morewvware wvwareMultiple integer overflows in the WV library in wvWare (formerly mswordview) before 1.2.3, as used by AbiWord, KWord, and possibly other products, allow user-assisted remote attackers to execute arbitrary code via a crafted Microsoft Word (DOC) file that produces (1) large LFO clfolvl values in the wvGetLFO_records function or (2) a large LFO nolfo value in the wvGetFLO_PLF function.CVSS5.1MediumEPSS3.66%RoutineCVE-2006-3376wvware · libwmf +5 morewvware libwmfInteger overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.CVSS7.5HighEPSS7.68%RoutineCVE-2006-2197wvware · wv2 +1 morewvware wv2Integer overflow in wv2 before 0.2.3 might allow context-dependent attackers to execute arbitrary code via a crafted Microsoft Word document.CVSS6.5MediumEPSS2.55%PrioritiseCVE-2004-0645abisource · community_abiword +3 moreabisource community_abiwordBuffer overflow in the wvHandleDateTimePicture function in wv library (wvWare) 0.7.4 through 0.7.6 and 1.0.0 allows remote attackers to execute arbitrary code via a document with a long DateTime field.CVSS10.0CriticalEPSS8.45%