Every CVE Search/ Get API key

CVE-2026-26824

libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE...

6.5 MediumFix available

libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before being consumed by ole2_validate_sector_chain(), which may result in application crashes or potential information disclosure when processing a crafted XLS file

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
Low

Exploit likelihood

0.27%Up 0.3 points since Jun 4, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before being consumed by ole2_validate_sector_chain(), which may result in application crashes or potential information disclosure when processing a crafted XLS file

Record
CVE-2026-26824
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-457
Updated
2026-11-02
EUVDEUVD-2026-34178 6.5

libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before being consumed by ole2_validate_sector_chain(), which may result in application crashes or potential information disclosure when processing a crafted XLS file

Record
EUVD-2026-34178
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-hwmf-9wj8-35pw 6.5

libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE...

libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before being consumed by ole2_validate_sector_chain(), which may result in application crashes or potential information disclosure when processing a crafted XLS file

Record
GHSA-hwmf-9wj8-35pw
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-457
Updated
2026-11-02
NVD 6.5

libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before being consumed by ole2_validate_sector_chain(), which may result in application crashes or potential information disclosure when processing a crafted XLS file

Record
CVE-2026-26824
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-457
Updated
2026-11-02
OSV 6.5

libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before being consumed by ole2_validate_sector_chain(), which may result in application crashes or potential information disclosure when processing a crafted XLS file

Record
CVE-2026-26824
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2026-26824 6.5

libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before being consumed by ole2_validate_sector_chain(), which may result in application crashes or potential information disclosure when processing a crafted XLS file

Record
DEBIAN-CVE-2026-26824
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
Show 4 moreShow less
OSVJLSEC-2026-1301 6.5

libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before being consumed by ole2_validate_sector_chain(), which may result in application crashes or potential information disclosure when processing a crafted XLS file

Record
JLSEC-2026-1301
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-26824 6.5

libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before being consumed by ole2_validate_sector_chain(), which may result in application crashes or potential information disclosure when processing a crafted XLS file

Record
UBUNTU-CVE-2026-26824
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVopenSUSE-SU-2026:12110-1 No score

libxls-devel-1.6.4-1.1 on GA media

These are all security issues fixed in the libxls-devel-1.6.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12110-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22128-1 No score

Security update for libxls

This update for libxls fixes the following issues:

Changes in libxls:

Update to release 1.6.4:

  • Fix use of uninitialized memory in OLE parsing [boo#1267687, CVE-2026-26825]
  • Fix use of uninitialized memory in read_MSAT [boo#1267608, CVE-2026-26824]
  • Fix use of uninitialized memory in xls_parseWorkBook
  • Fix out-of-bounds reads in the formula dumper
  • Handle allocation failures in OLE, workbook and string code
  • Read SummaryInformation streams at their real size
  • Keep full precision when converting numeric cells to strings
  • Fix "creation of UTF-8 locale failed" in xls2csv

Update to release 1.6.3:

  • Fix style record size check on big-endian systems
  • Fix header include in C++ mode
  • Fix buffer overflows when parsing style records
  • Fix infinite loop with self-referencing sectors
Record
openSUSE-SU-2026:22128-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
r-cran-readxl
Debian:12
 All versions, plus listed versions
1.4.2-11.4.3-11.4.4-11.4.5-11.5.0-11.5.0.1-11.6.0-1
 None known
r-cran-readxl
Debian:13
 All versions, plus listed versions
1.4.5-11.5.0-11.5.0.1-11.6.0-1
 None known
r-cran-readxl
Debian:14
 before 1.6.0-1, plus listed versions
1.4.5-11.5.0-11.5.0.1-1
1.6.0-1
libxls_jll
Julia
 All versions None known
r-cran-readxl
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.1.0-1
 None known
r-cran-readxl
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.0.0-1build11.0.0-2
 None known
r-cran-readxl
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.3.1-21.3.1-2build1
 None known
r-cran-readxl
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.3.1-2build2
 None known
r-cran-readxl
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.4.3-1
 None known
r-cran-readxl
Ubuntu:25.10
 All versions, plus listed versions
1.4.5-1
 None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
r-cran-readxl
Ubuntu:26.10
 All versions, plus listed versions
1.4.5-11.5.0-1
 None known
r-cran-readxl
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.4.5-1
 None known
libxls
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.6.4-1.1
1.6.4-1.1
libxls
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 1.6.4-bp160.1.1
1.6.4-bp160.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-26824 is a medium vulnerability (CVSS 6.5) in Libxls Project Libxls, published June 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in r-cran-readxl 1.6.0-1.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open