CVE-2018-4038: Atlantiswordprocessor Atlantis Word Processor

High severity, CVSS 7.8. EPSS: 1.3% chance of exploitation in the next 30 days.

An exploitable arbitrary write vulnerability exists in the open document format parser of the Atlantis Word Processor, version 3.2.7.2, while trying to null-terminate a string. A specially crafted document can allow an attacker to pass an untrusted value as a length to a constructor. This constructor will miscalculate a length and then use it to calculate the position to write a null byte. This can allow an attacker to corrupt memory, which can result in code execution under the context of the application. An attacker must convince a victim to open a specially crafted document in order to trigger this vulnerability.

Affected products

• Atlantiswordprocessor Atlantis Word Processor: version 3.2.7.1 only; version 3.2.7.2 only

Published 2018-12-01. Last modified 2026-06-17.