What’s Vulnerable › Vulnerabilities

CVE-2026-26824

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-06-03 · updated 2026-09-23
• Weakness: CWE-457

Description

libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before being consumed by ole2_validate_sector_chain(), which may result in application crashes or potential information disclosure when processing a crafted XLS file

Affected products

• libxls: through 1.6.3

References

• https://github.com/libxls/libxls/commit/9adebc9b6d60db21f25ddc898e8760eeb69d6529
• https://github.com/libxls/libxls/issues/153
• https://github.com/libxls/libxls/issues/155
• https://github.com/libxls/libxls/issues/155

Get alerted when CVE-2026-26824 or the next vulnerability affects your stack