CVE-2018-20452
The read_MSAT_body function in ole.c in libxls 1.4.0 has an invalid free that allows attackers to...
The read_MSAT_body function in ole.c in libxls 1.4.0 has an invalid free that allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, because of inconsistent memory management (new versus free) in ole2_read_header in ole.c.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The read_MSAT_body function in ole.c in libxls 1.4.0 has an invalid free that allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, because of inconsistent memory management (new versus free) in ole2_read_header in ole.c.
- Record
CVE-2018-20452- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
The read_MSAT_body function in ole.c in libxls 1.4.0 has an invalid free that allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, because of inconsistent memory management (new versus free) in ole2_read_header in ole.c.
- Record
CVE-2018-20452- Updated
- 2026-11-02
EUVDEUVD-2018-13007 No score
The read_MSAT_body function in ole.c in libxls 1.4.0 has an invalid free that allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, because of inconsistent memory management (new versus free) in ole2_read_header in ole.c.
- Record
EUVD-2018-13007- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3hq6-4m9g-pfg4
The read_MSAT_body function in ole.c in libxls 1.4.0 has an invalid free that allows attackers to...
The read_MSAT_body function in ole.c in libxls 1.4.0 has an invalid free that allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, because of inconsistent memory management (new versus free) in ole2_read_header in ole.c.
- Record
GHSA-3hq6-4m9g-pfg4- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
The read_MSAT_body function in ole.c in libxls 1.4.0 has an invalid free that allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, because of inconsistent memory management (new versus free) in ole2_read_header in ole.c.
- Record
CVE-2018-20452- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-20452
The read_MSAT_body function in ole.c in libxls 1.4.0 has an invalid free that allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, because of inconsistent memory management (new versus free) in ole2_read_header in ole.c.
- Record
DEBIAN-CVE-2018-20452- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-20452
The read_MSAT_body function in ole.c in libxls 1.4.0 has an invalid free that allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, because of inconsistent memory management (new versus free) in ole2_read_header in ole.c.
- Record
UBUNTU-CVE-2018-20452- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRSEC-2023-1 No score
Double-free and invalid free vulnerabilities
The readxl R package has been found susceptible to vulnerabilities due to its dependency on libxls library version 1.4.0. Two distinct memory management issues were discovered in the read_MSAT and read_MSAT_body functions within the ole.c component of libxls. The first vulnerability is a double-free flaw in the read_MSAT function, which could be exploited by an attacker using a crafted file to cause a Denial of Service (DoS), resulting in an application crash. This vulnerability is different from CVE-2017-2897. The second vulnerability is an invalid free flaw in the read_MSAT_body function. This issue, stemming from inconsistent memory management in the ole2_read_header function, allows attackers to trigger a DoS, application crash, or possibly an unspecified impact through a specially crafted file.
- Record
RSEC-2023-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
r-cran-readxlDebian:12 |
before 1.2.0.9000-1 | 1.2.0.9000-1 |
r-cran-readxlDebian:13 |
before 1.2.0.9000-1 | 1.2.0.9000-1 |
r-cran-readxlDebian:14 |
before 1.2.0.9000-1 | 1.2.0.9000-1 |
readxlCRAN From an advisory covering 2 CVEs |
0.1.0 up to 1.3.0, plus listed versions 0.1.11.0.01.1.01.2.0 |
1.3.0 |
r-cran-readxlUbuntu:16.04:LTS |
All versions, plus listed versions 0.1.0-1 |
None known |
r-cran-readxlUbuntu:18.04:LTS |
All versions, plus listed versions 1.0.0-1build11.0.0-2 |
None known |
r-cran-readxlUbuntu:20.04:LTS |
All versions, plus listed versions 1.3.1-21.3.1-2build1 |
None known |
r-cran-readxlUbuntu:22.04:LTS |
All versions, plus listed versions 1.3.1-2build2 |
None known |
r-cran-readxlUbuntu:24.04:LTS |
All versions, plus listed versions 1.4.3-1 |
None known |
r-cran-readxlUbuntu:25.10 |
All versions, plus listed versions 1.4.5-1 |
None known |
r-cran-readxlUbuntu:26.10 |
All versions, plus listed versions 1.4.5-11.5.0-1 |
None known |
r-cran-readxlUbuntu:26.04:LTS |
All versions, plus listed versions 1.4.5-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-20452 is a high vulnerability (CVSS 8.8) in Libxls Project Libxls, published December 25, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.50%, the 74th percentile. Fixed in r-cran-readxl 1.2.0.9000-1.