CVE-2026-26824

Description

libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before being consumed by ole2_validate_sector_chain(), which may result in application crashes or potential information disclosure when processing a crafted XLS file

Traduire en français

Produits concernés

• Libxls project libxls

Scores CVSS

Faiblesses (CWE)

• CWE-457

Références

• https://github.com/libxls/libxls/commit/9adebc9b6d60db21f25ddc898e8760eeb69d6529
• https://github.com/libxls/libxls/issues/153
• https://github.com/libxls/libxls/issues/155 ExploitIssue Tracking
• https://github.com/libxls/libxls/issues/155 ExploitIssue Tracking

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories