CVE-2014-9275

UnRTF allows remote attackers to cause a denial of service (out-of-bounds memory access and crash...

7.5 HighFix available

CVE-2014-9275 is a high vulnerability (CVSS 7.5) in Unrtf Project Unrtf, published December 9, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.74%, the 91st percentile. Fixed in unrtf 0.21.5-2.

Severity: 7.5 HighCVSS 2.0, NVD
Exploit chance: 4.74%EPSS, 91st percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 0.21.5-2unrtf +5 more

Description

UnRTF allows remote attackers to cause a denial of service (out-of-bounds memory access and crash) and possibly execute arbitrary code via a crafted RTF file.

Exploit likelihood

4.74%Down 2.8 points since Feb 4, 2022

Affected products

unrtf project unrtf

Affected packages

Affected packages
Package	Affected	Fixed
`unrtf` Debian:12	before 0.21.5-2	0.21.5-2
`unrtf` Debian:13	before 0.21.5-2	0.21.5-2
`unrtf` Debian:14	before 0.21.5-2	0.21.5-2
`unrtf` Debian:6.0 From an advisory covering 2 CVEs	before 0.19.3-1.1+deb6u1, plus listed versions 0.19.3-1.1	0.19.3-1.1+deb6u1
`unrtf` Debian:7 From an advisory covering 2 CVEs	before 0.21.5-3~deb7u1, plus listed versions 0.19.3-1.10.21.2-10.21.2-20.21.3-10.21.3-20.21.5-10.21.5-2	0.21.5-3~deb7u1
`unrtf` Mageia:4 From an advisory covering 2 CVEs	before 0.21.7-1.mga4	0.21.7-1.mga4

What each source reports

NVD Score used7.5

UnRTF allows remote attackers to cause a denial of service (out-of-bounds memory access and crash) and possibly execute arbitrary code via a crafted RTF file.

Record: CVE-2014-9275
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE ListNo score

UnRTF allows remote attackers to cause a denial of service (out-of-bounds memory access and crash) and possibly execute arbitrary code via a crafted RTF file.

Record: CVE-2014-9275
Updated: 2026-11-02

EUVDEUVD-2014-9100No score

UnRTF allows remote attackers to cause a denial of service (out-of-bounds memory access and crash) and possibly execute arbitrary code via a crafted RTF file.

Record: EUVD-2014-9100
Updated: 2026-11-03

GitHub AdvisoriesGHSA-745j-qpxw-g265No score

UnRTF allows remote attackers to cause a denial of service (out-of-bounds memory access and crash...

UnRTF allows remote attackers to cause a denial of service (out-of-bounds memory access and crash) and possibly execute arbitrary code via a crafted RTF file.

Record: GHSA-745j-qpxw-g265
Weakness: CWE-119
Updated: 2026-11-02

OSVNo score

UnRTF allows remote attackers to cause a denial of service (out-of-bounds memory access and crash) and possibly execute arbitrary code via a crafted RTF file.

Record: CVE-2014-9275
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-9275No score

UnRTF allows remote attackers to cause a denial of service (out-of-bounds memory access and crash) and possibly execute arbitrary code via a crafted RTF file.

Record: DEBIAN-CVE-2014-9275
Updated: 2026-11-02

OSVMGASA-2014-0533No score

Updated unrtf package fixes security vulnerabilities

Updated unrtf package fixes security vulnerabilities:

Michal Zalewski reported an out-of-bounds memory access vulnerability in unrtf. Processing a malformed RTF file could lead to a segfault while accessing a pointer that may be under the attacker's control. This would lead to a denial of service (application crash) or, potentially, the execution of arbitrary code (CVE-2014-9274).

Hanno Böck also reported a number of other crashes in unrtf (CVE-2014-9275).

Record: MGASA-2014-0533
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 8 moreShow less