On Mon, Aug 17, 2026 at 02:12:22PM +0000, vulnreport wrote: > The read continues through adjacent heap memory until a NUL byte is > encountered. The resulting bytes can then be copied into antiword's > output.
This doesn't seem like an information disclosure problem though - you're suggesting this can happen when processing a document file which the attacker provides, so the attacker knows the content of that file already. The contents of Debian's antiword packages is public too (similarly for any shared library dependencies). > antiword 0.37-17 from Ubuntu APT's sources Again, please test with ***DEBIAN*** packages when reporting bugs to Debian. > // summary.c > szStart = (char *)aucBuffer + ulOffset + 8; /* summary.c:152, attacker > offset */ > ... > szResult = xstrdup(szStart); /* strlen+strcpy over-read ??? > output */ This looks like it is the same problem as https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1008092 which the reporter apparently has a reproducer for but never responded when asked repeatedly to provide it. I did some work on a patch for that a few months ago - I'll dig it out. Cheers, Olly
