CVE-2026-111127: catdoc through 0.95 Out-of-Bounds Read via xls2csv copy_unicode_string

Q: What conditions are required to exploit this issue?

An attacker must cause xls2csv to process a crafted .xls file. The malicious file uses a LABEL, STRING, or SST record that declares 0xFFFF two-byte characters, triggering the unchecked character count in copy_unicode_string().

Q: Which deployments are exposed?

Installations of catdoc through version 0.95 are affected when xls2csv is used to parse untrusted or attacker-controlled .xls files. The attack is local according to the supplied vector, but exploitation still requires user interaction to process the crafted file.

Q: What is the impact if exploitation succeeds?

The out-of-bounds read can disclose adjacent process memory through xls2csv output. It can also crash the xls2csv process, causing a denial of service.

Q: What can be done before a fix is available?

Do not process untrusted .xls files with xls2csv. Restrict .xls inputs to trusted sources and isolate or monitor any workflow that must convert externally supplied spreadsheets.

Published Oct 15, 2026

Updated

catdoc through 0.95 contains an out-of-bounds read vulnerability in copyunicodestring() in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count. Attackers can supply a crafted .xls file declaring 0xFFFF two-byte characters in LABEL, STRING, or SST records to disclose adjacent memory through xls2csv output or crash the process.

Affected Software

1 affected component

catdoc catdoc<=0.95

Event History

Oct 15, 2026

CVE Published

via MITRE·06:57 PM

Data Sourced

via MITRE·06:57 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required to exploit this issue?

An attacker must cause xls2csv to process a crafted .xls file. The malicious file uses a LABEL, STRING, or SST record that declares 0xFFFF two-byte characters, triggering the unchecked character count in copy_unicode_string().

Which deployments are exposed?

Installations of catdoc through version 0.95 are affected when xls2csv is used to parse untrusted or attacker-controlled .xls files. The attack is local according to the supplied vector, but exploitation still requires user interaction to process the crafted file.

What is the impact if exploitation succeeds?

The out-of-bounds read can disclose adjacent process memory through xls2csv output. It can also crash the xls2csv process, causing a denial of service.

What can be done before a fix is available?

Do not process untrusted .xls files with xls2csv. Restrict .xls inputs to trusted sources and isolate or monitor any workflow that must convert externally supplied spreadsheets.

CVE-2026-111127: catdoc through 0.95 Out-of-Bounds Read via xls2csv copy_unicode_string

Affected Software

Event History

Frequently Asked Questions

What conditions are required to exploit this issue?

Which deployments are exposed?

What is the impact if exploitation succeeds?

What can be done before a fix is available?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to exploit this issue?

Which deployments are exposed?

What is the impact if exploitation succeeds?

What can be done before a fix is available?