CVE-2026-26825: Medium severity libxls libxls vulnerability
A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reachable via xlsparseWorkBook() and is triggered by uninitialized heap memory originating from the OLE layer (ole2read). The flaw is detectable with MemorySanitizer (MSAN) and can lead to undefined behavior, incorrect parsing logic, or potential information disclosure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Build and test libxls under MemorySanitizer (MSAN) and run parsing tests/fuzzers against malformed XLS inputs (exercise xls_parseWorkBook / ole2_read) to detect use-of-uninitialized-memory issues.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26825?
The severity of CVE-2026-26825 is medium with a CVSS score of 5.3.
How do I fix CVE-2026-26825?
To fix CVE-2026-26825, upgrade to a patched version of libxls that addresses the use-of-uninitialized memory vulnerability.
What software is affected by CVE-2026-26825?
CVE-2026-26825 affects libxls version 1.6.3 when parsing malformed XLS files.
How is CVE-2026-26825 exploited?
CVE-2026-26825 can be exploited by triggering the flaw through the xls_parseWorkBook() function with malformed XLS files.
What tools can detect CVE-2026-26825?
CVE-2026-26825 is detectable with MemorySanitizer (MSAN) which identifies uninitialized memory usage.