CVE-2026-79592: Libxls libxls vulnerability
Published Sep 10, 2026
·Updated
An out-of-bounds read vulnerability exists in the xlsdumpSummary() function of libxls 1.6.3 due to insufficient validation of file-controlled OLE summary offsets.
Affected Software
1 affected component
libxls libxls=1.6.3
Event History
Sep 10, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What must an attacker provide to trigger the flaw?
The attacker needs to supply a file with controlled OLE summary offsets that is processed by the xls_dumpSummary() function.
2
Which deployments are exposed?
Deployments using libxls 1.6.3 are affected when they process attacker-controlled or otherwise untrusted XLS files through the vulnerable summary-dumping functionality.
3
What can be done if updating is not immediately possible?
Avoid processing untrusted XLS files with functionality that invokes xls_dumpSummary(), and validate or isolate such files before analysis.