Unrtf
Vendor:
First CVE: Dec 9, 2014 · Active for 11 years
5
Total CVEs
More Total CVEs than 79% of tracked products
1.7
Avg CVEs / Year
Higher CVE frequency than 62% of tracked products
7.2
Avg CVSS
Higher Avg CVSS than 48% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Unrtf over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 9, 2014
11 years ago
Most Recent CVE
Dec 30, 2025
210 days ago
CVE Severity & Scoring
Unrtf5 CVEs
20%
80%
All CVEs353,240 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local1 (20.0%)
Network2 (40.0%)
Unknown2 (40.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low3 (60.0%)
High0 (0.0%)
Unknown2 (40.0%)
User Interaction
None3 (60.0%)
Unknown2 (40.0%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None3 (60.0%)
Unknown2 (40.0%)
Top CVEs
Signals from CVEs in this product scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2016-10091HIGH Multiple stack-based buffer overflows in unrtf 0.21.9 allow remote attackers to cause a denial-of-service by writing a negative integer to the (1) cmd_expand function, (2) cmd_embo | Apr 21, 2017 | 7.5 | 25 | NO | NO |
CVE-2025-65411HIGH A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the search_pat | Dec 30, 2025 | 7.5 | 24 | NO | NO |
CVE-2025-65410MEDIUM A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted input into the filename parameter. | Dec 23, 2025 | 6.2 | 22 | NO | NO |
CVE-2014-9275HIGH UnRTF allows remote attackers to cause a denial of service (out-of-bounds memory access and crash) and possibly execute arbitrary code via a crafted RTF file. | Dec 9, 2014 | 7.5 | 21 | NO | NO |
CVE-2014-9274HIGH UnRTF allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code as demonstrated by a file containing the string "{\cb-999999999". | Dec 9, 2014 | 7.5 | 21 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (5 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (5 CVEs).
Media Mentions
Signals from CVEs in this product scope (5 CVEs).
Top CNAs Publishing CVEs For Unrtf
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 0.21.9 | 1 | 7.5 | 2.8% | 0 | 0 |
| 0.21.10 | 2 | 6.8 | 0.4% | 0 | 0 |