CVE-2026-26825

5.3 MEDIUM

A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files

Published: 2026-06-03 · Last updated: 2026-06-08

Severity and scoring

CVSS: 5.3 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE: CWE-908

Affected products

Vendor	Product
libxls_project	libxls

Description

A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reachable via xls_parseWorkBook() and is triggered by uninitialized heap memory originating from the OLE layer (ole2_read). The flaw is detectable with MemorySanitizer (MSAN) and can lead to undefined behavior, incorrect parsing logic, or potential information disclosure.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-26825
[Exploit reference]https://github.com/libxls/libxls/issues/156

Related CVEs

Same vendor

CVE-2026-26824 — libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser (6.5 MEDIUM)

Same CWE

CVE-2026-42969 — Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally (5.5 MEDIUM)
CVE-2026-48104 — 7-Zip is a file archiver with a high compression ratio (4.2 MEDIUM)
CVE-2026-48101 — 7-Zip is a file archiver with a high compression ratio (6.5 MEDIUM)
CVE-2026-11089 — Uninitialized Use in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to ... (6.5 MEDIUM)
CVE-2026-46257 — In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/timer-sp804: Fix an Oops when read_current_timer... (5.5 MEDIUM)