CVE-2018-20450
The read_MSAT function in ole.c in libxls 1.4.0 has a double free that allows attackers to cause...
The read_MSAT function in ole.c in libxls 1.4.0 has a double free that allows attackers to cause a denial of service (application crash) via a crafted file, a different vulnerability than CVE-2017-2897.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The read_MSAT function in ole.c in libxls 1.4.0 has a double free that allows attackers to cause a denial of service (application crash) via a crafted file, a different vulnerability than CVE-2017-2897.
- Record
CVE-2018-20450- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-415
- Updated
- 2026-11-02
CVE List No score
The read_MSAT function in ole.c in libxls 1.4.0 has a double free that allows attackers to cause a denial of service (application crash) via a crafted file, a different vulnerability than CVE-2017-2897.
- Record
CVE-2018-20450- Updated
- 2026-11-02
EUVDEUVD-2018-13005 No score
The read_MSAT function in ole.c in libxls 1.4.0 has a double free that allows attackers to cause a denial of service (application crash) via a crafted file, a different vulnerability than CVE-2017-2897.
- Record
EUVD-2018-13005- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r369-mhv6-47fj
The read_MSAT function in ole.c in libxls 1.4.0 has a double free that allows attackers to cause...
The read_MSAT function in ole.c in libxls 1.4.0 has a double free that allows attackers to cause a denial of service (application crash) via a crafted file, a different vulnerability than CVE-2017-2897.
- Record
GHSA-r369-mhv6-47fj- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-415
- Updated
- 2026-11-02
OSV
The read_MSAT function in ole.c in libxls 1.4.0 has a double free that allows attackers to cause a denial of service (application crash) via a crafted file, a different vulnerability than CVE-2017-2897.
- Record
CVE-2018-20450- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-20450
The read_MSAT function in ole.c in libxls 1.4.0 has a double free that allows attackers to cause a denial of service (application crash) via a crafted file, a different vulnerability than CVE-2017-2897.
- Record
DEBIAN-CVE-2018-20450- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-20450
The read_MSAT function in ole.c in libxls 1.4.0 has a double free that allows attackers to cause a denial of service (application crash) via a crafted file, a different vulnerability than CVE-2017-2897.
- Record
UBUNTU-CVE-2018-20450- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRSEC-2023-1 No score
Double-free and invalid free vulnerabilities
The readxl R package has been found susceptible to vulnerabilities due to its dependency on libxls library version 1.4.0. Two distinct memory management issues were discovered in the read_MSAT and read_MSAT_body functions within the ole.c component of libxls. The first vulnerability is a double-free flaw in the read_MSAT function, which could be exploited by an attacker using a crafted file to cause a Denial of Service (DoS), resulting in an application crash. This vulnerability is different from CVE-2017-2897. The second vulnerability is an invalid free flaw in the read_MSAT_body function. This issue, stemming from inconsistent memory management in the ole2_read_header function, allows attackers to trigger a DoS, application crash, or possibly an unspecified impact through a specially crafted file.
- Record
RSEC-2023-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
r-cran-readxlDebian:12 |
before 1.2.0.9000-1 | 1.2.0.9000-1 |
r-cran-readxlDebian:13 |
before 1.2.0.9000-1 | 1.2.0.9000-1 |
r-cran-readxlDebian:14 |
before 1.2.0.9000-1 | 1.2.0.9000-1 |
readxlCRAN From an advisory covering 2 CVEs |
0.1.0 up to 1.3.0, plus listed versions 0.1.11.0.01.1.01.2.0 |
1.3.0 |
r-cran-readxlUbuntu:16.04:LTS |
All versions, plus listed versions 0.1.0-1 |
None known |
r-cran-readxlUbuntu:18.04:LTS |
All versions, plus listed versions 1.0.0-1build11.0.0-2 |
None known |
r-cran-readxlUbuntu:20.04:LTS |
All versions, plus listed versions 1.3.1-21.3.1-2build1 |
None known |
r-cran-readxlUbuntu:22.04:LTS |
All versions, plus listed versions 1.3.1-2build2 |
None known |
r-cran-readxlUbuntu:24.04:LTS |
All versions, plus listed versions 1.4.3-1 |
None known |
r-cran-readxlUbuntu:25.10 |
All versions, plus listed versions 1.4.5-1 |
None known |
r-cran-readxlUbuntu:26.10 |
All versions, plus listed versions 1.4.5-11.5.0-1 |
None known |
r-cran-readxlUbuntu:26.04:LTS |
All versions, plus listed versions 1.4.5-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-20450 is a medium vulnerability (CVSS 6.5) in Libxls Project Libxls, published December 25, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.06%, the 64th percentile. Fixed in r-cran-readxl 1.2.0.9000-1.