← Back

CVE-2026-26824

nvd nist
Published: Jun 3, 2026Modified: Jul 22, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Exploitability: 3.9 / Impact: 2.5
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before being consumed by ole2_validate_sector_chain(), which may result in application crashes or potential information disclosure when processing a crafted XLS file

Affected (1)

Libxls Project
1 product
Libxls
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Libxls
Up to 1.6.3

Related CWEs

CWE-457
Use of Uninitialized Variable
The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

References (2)

Source: cve@mitre.org
ExploitIssue Tracking
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
ExploitIssue Tracking

Timeline

No history available yet.