CVE-2026-26824: Medium severity libxls libxls vulnerability
libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in readMSAT() is not fully initialized before being consumed by ole2validatesectorchain(), which may result in application crashes or potential information disclosure when processing a crafted XLS file
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libxlsto a version that resolves this vulnerability.Fixed in 1.6.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26824?
The severity of CVE-2026-26824 is rated as medium with a CVSS score of 6.5.
What kind of vulnerability is described in CVE-2026-26824?
CVE-2026-26824 is a use of uninitialized memory vulnerability in the OLE container parser of libxls.
How do I fix CVE-2026-26824?
To fix CVE-2026-26824, upgrade to libxls version 1.6.4 or later where the vulnerability has been addressed.
What impact does CVE-2026-26824 have on applications?
CVE-2026-26824 may lead to application instability or crashes due to the uninitialized memory being consumed.
Which versions of libxls are affected by CVE-2026-26824?
CVE-2026-26824 affects libxls versions up to and including 1.6.3.