CVE-2026-79591: Use After Free
Published Sep 10, 2026
·Updated
A heap-buffer-overflow and use-after-free vulnerability exists in the xlsgetCSS() function of libxls 1.6.3 due to insufficient validation of a file-controlled font index.
Affected Software
1 affected component
libxls libxls=1.6.3
Event History
Sep 10, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
Which deployments should be prioritized for review?
Prioritize applications that use libxls 1.6.3 to parse XLS files, especially where XLS input can be supplied or influenced by untrusted users or external sources.
2
What must an attacker provide to trigger the issue?
The issue is associated with a file-controlled font index processed by the xls_getCSS() function. An attacker would need to cause the affected libxls code to parse an XLS file containing an insufficiently validated font index.