CVE-2026-111126: catdoc through 0.95 Out-of-Bounds Read in xls2csv MULRK Record Handler
catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of processitem() in src/xlsparse.c that allows attackers to read past the static rec buffer via a crafted end column. Attackers can supply a crafted .xls workbook or BIFF stream with a large endcol to xls2csv to disclose adjacent process memory as CSV cells or crash the process.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that run xls2csv on attacker-controlled or otherwise untrusted .xls workbooks or BIFF streams are exposed. Exploitation requires a user or workflow to provide the crafted input to xls2csv.
What does an attacker need to provide?
The attacker needs a crafted .xls workbook or BIFF stream containing a MULRK record with a large end-column value. No privileges are required, but user interaction is required to cause xls2csv to process the input.
What is the likely impact after successful exploitation?
The out-of-bounds read can disclose adjacent process memory through CSV cell output or cause the xls2csv process to crash. The supplied severity vector indicates low confidentiality impact and high availability impact.