CVE-2026-26824
6.5 MEDIUMlibxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser
Published: 2026-06-03 · Last updated: 2026-06-04
Severity and scoring
- CVSS
- 6.5 MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
- CWE
- CWE-457
Affected products
| Vendor | Product |
|---|---|
| libxls_project | libxls |
Description
libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before being consumed by ole2_validate_sector_chain(), which may result in application crashes or potential information disclosure when processing a crafted XLS file
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-26824
- [Exploit reference]https://github.com/libxls/libxls/issues/155
- [Exploit reference]https://github.com/libxls/libxls/issues/155
Related CVEs
Same vendor
- CVE-2026-26825 — A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files (5.3 MEDIUM)
Same CWE
- CVE-2026-9754 — An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the fi... (6.5 MEDIUM)
- CVE-2026-11696 — Uninitialized Use in Video in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer... (5.3 MEDIUM)
- CVE-2026-11668 — Uninitialized Use in Codecs in Google Chrome on Linux, ChromeOS prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin da... (4.3 MEDIUM)
- CVE-2026-11268 — Uninitialized Use in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a c... (6.5 MEDIUM)
- CVE-2026-11159 — Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML ... (4.3 MEDIUM)