Libxls Project vulnerabilities
Published CVEs affecting Libxls Project products: 2 record(s), with severity, exploitation and fixes.
CVE-2026-26825
Medium · 5.3
CWE-908 Jun 3, 2026
Use of Uninitialized Resource in Libxls Project Libxls
A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reachable via xls_parseWorkBook() and is triggered by uninitialized heap memory originating from the OLE layer (ole2_read). The flaw is detectable with MemorySanitizer (MSAN) and can lead to undefined behavior, incorrect parsing logic, or potential information disclosure.
CVE-2026-26824
Medium · 6.5
CWE-457 Jun 3, 2026
Use of Uninitialized Variable in Libxls Project Libxls
libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before being consumed by ole2_validate_sector_chain(), which may result in application crashes or potential information disclosure when processing a crafted XLS file