CVE-2026-110600: xlsxio through 0.2.37 NULL Pointer Dereference via Worksheet Relationship Without Id
xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in mainsheetgetsheetfileexpatcallbackelementstart() in lib/xlsxioread.c that allows attackers to crash applications via crafted files. Attackers can supply a .xlsx file whose workbook.xml.rels contains a worksheet Relationship lacking an Id attribute, crashing the process when xlsxioreadsheetopen() is called.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using xlsxio through 0.2.37 are exposed when they open attacker-controlled or otherwise untrusted .xlsx files. The affected path is reached when xlsxioread_sheet_open() processes the workbook relationship data.
What must an attacker provide to trigger the crash?
The attacker must supply a crafted .xlsx file containing a worksheet Relationship in workbook.xml.rels that lacks an Id attribute. User interaction is required to cause the application to open the malicious file.
What is the impact if exploitation succeeds?
The affected application process can crash due to a NULL pointer dereference. The provided data indicates an availability impact only, with no confidentiality or integrity impact.