CVE Intelligence

Catdoc vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Catdoc products: 2 record(s), with severity, exploitation and fixes.

Catdoc 2

Exploited only (KEV) →

CVE-2026-111127 Medium · 6.1 CWE-125 Oct 15, 2026
catdoc through 0.95 Out-of-Bounds Read via xls2csv copy_unicode_string
catdoc through 0.95 contains an out-of-bounds read vulnerability in copy_unicode_string() in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count. Attackers can supply a crafted .xls file declaring 0xFFFF two-byte characters in LABEL, STRING, or SST records to disclose adjacent memory through xls2csv output or crash the process.
CVE-2026-111126 Medium · 6.1 CWE-125 Oct 15, 2026
catdoc through 0.95 Out-of-Bounds Read in xls2csv MULRK Record Handler
catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of process_item() in src/xlsparse.c that allows attackers to read past the static rec buffer via a crafted end column. Attackers can supply a crafted .xls workbook or BIFF stream with a large endcol to xls2csv to disclose adjacent process memory as CSV cells or crash the process.