CVE-2026-26825

5.3 mediumEPSS 0.2%

Medium (5.3) in libxls project libxls. EPSS 0.2% chance of exploitation in the next 30 days.

A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reachable via xls_parseWorkBook() and is triggered by uninitialized heap memory originating from the OLE layer (ole2_read). The flaw is detectable with MemorySanitizer (MSAN) and can lead to undefined behavior, incorrect parsing logic, or potential information disclosure.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-31)
CWE: CWE-908
Published: 2026-06-03
Modified: 2026-09-23
Record from: the NVD, synced 2026-10-19

Affected

libxls_project:libxls

References

https://github.com/libxls/libxls/commit/9adf88f4e3b304e397f70ac189e70776edb6d5a3
https://github.com/libxls/libxls/issues/153
https://github.com/libxls/libxls/issues/156

Check your stack JSON