CVE-2026-111127: catdoc through 0.95 Out-of-Bounds Read via xls2csv copy_unicode_string
catdoc through 0.95 contains an out-of-bounds read vulnerability in copyunicodestring() in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count. Attackers can supply a crafted .xls file declaring 0xFFFF two-byte characters in LABEL, STRING, or SST records to disclose adjacent memory through xls2csv output or crash the process.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
An attacker must cause xls2csv to process a crafted .xls file. The malicious file uses a LABEL, STRING, or SST record that declares 0xFFFF two-byte characters, triggering the unchecked character count in copy_unicode_string().
Which deployments are exposed?
Installations of catdoc through version 0.95 are affected when xls2csv is used to parse untrusted or attacker-controlled .xls files. The attack is local according to the supplied vector, but exploitation still requires user interaction to process the crafted file.
What is the impact if exploitation succeeds?
The out-of-bounds read can disclose adjacent process memory through xls2csv output. It can also crash the xls2csv process, causing a denial of service.
What can be done before a fix is available?
Do not process untrusted .xls files with xls2csv. Restrict .xls inputs to trusted sources and isolate or monitor any workflow that must convert externally supplied spreadsheets.