CVE-2026-128340: ExcelJS through 4.4.0 Memory Exhaustion via Oversized Defined Name Range
ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal heap out-of-memory error during xlsx.load().
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications that use ExcelJS through version 4.4.0 and load attacker-supplied XLSX workbooks are exposed. The failure occurs while processing defined-name ranges from xl/workbook.xml during xlsx.load().
What does an attacker need to trigger the denial of service?
An attacker needs to provide a workbook containing an oversized defined-name range, such as a range spanning an entire worksheet. No privileges or user interaction are required according to the supplied severity vector.
What is the operational impact of successful exploitation?
Processing the crafted workbook can consume heap memory until the application terminates with an uncatchable fatal out-of-memory error. The provided data indicates availability impact only, with no confidentiality or integrity impact.