CVE-2026-26825

MEDIUM

libxls 1.6.3 - Use-After-Free in xls_parseWorkBook

Title source: llm

Description

A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reachable via xls_parseWorkBook() and is triggered by uninitialized heap memory originating from the OLE layer (ole2_read). The flaw is detectable with MemorySanitizer (MSAN) and can lead to undefined behavior, incorrect parsing logic, or potential information disclosure.

References (1)

Core 1

Core References

https://github.com/libxls/libxls/issues/156

Scores

CVSS v3 5.3

EPSS 0.0021

EPSS Percentile 10.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-908

Status published

Products (1)

libxls_project/libxls 1.6.3

Published Jun 03, 2026

Tracked Since Jun 04, 2026