← All detection heuristics · RTF
medium
RTF_WORD_COMPATIBILITY_PACKAGE
What it means
RTF contains a hidden Word compatibility or frame relationship package.
Why it fires
DrsE2oDoc/downRevStg drawing compatibility parts and embedded frame relationships are useful exploit-surface context, but occur in documents that predate CVE-2026-21514 and are not its trust-bypass primitive. The scanner therefore reports the structure without assigning a CVE.
Other RTF heuristics
RTF_EQUATION_EDITOR RTF_OBJCLASS_EQUATION RTF_MZ_HEX RTF_DDEAUTO_REGSVR32_SCRIPTLET RTF_MACOS_ZSH_LOADER RTF_PACKAGE_AUTOLINK_DELIVERY RTF_OBJAUTLINK RTF_INCLUDE_REMOTE RTF_EXCESSIVE_HEX RTF_PACKAGE_OLE RTF_OBFUSCATION RTF_PHP_IRC_BOT_SOURCE RTF_OBJCLASS_PACKAGE RTF_REMOTE_TEMPLATE RTF_EXPLOIT_TEMPLATE_ARTIFACT RTF_OBJUPDATE_LOOSE_HEX_PAYLOAD RTF_OBJUPDATE RTF_PFRAGMENTS_RELATED RTF_OBJEMB RTF_OBJDATA RTF_OLEPRES_STREAM RTF_OLE10NATIVE_STREAM