{"id":"CVE-2017-2896","aliases":["DEBIAN-CVE-2017-2896","DSA-4173-1","EUVD-2017-12037","GHSA-rpv6-jf42-c65x","RSEC-2023-0","UBUNTU-CVE-2017-2896"],"status":"published","title":"An exploitable out-of-bounds write vulnerability exists in the xls_mergedCells function of libxls...","description":"An exploitable out-of-bounds write vulnerability exists in the xls_mergedCells function of libxls 1.4. . A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.02136,"percentile":0.82129,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2017-11-20T22:00:00Z","modified":"2026-10-24T10:30:29Z","fixes":[{"ecosystem":"Debian:12","package":"r-cran-readxl","fixed_in":["1.0.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"r-cran-readxl","fixed_in":["1.0.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"r-cran-readxl","fixed_in":["1.0.0-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"r-cran-readxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"r-cran-readxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"r-cran-readxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"r-cran-readxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1-1+deb9u1"}]}],"versions":["0.1.1-1"],"bundled":7},{"source":"osv","ecosystem":"CRAN","package":"readxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"fixed":"1.1.0"}]}],"versions":["0.1.0","0.1.1","1.0.0"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"r-cran-readxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.0-1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"libxls","product":"libxls"},{"vendor":"libxls_project","product":"libxls"}],"references":[{"url":"https://www.debian.org/security/2018/dsa-4173","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202003-64","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0403","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2896"},{"url":"https://github.com/advisories/GHSA-rpv6-jf42-c65x"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-2896","tags":["advisory","web"]},{"url":"https://readxl.tidyverse.org/news/index.html#readxl-110","tags":["web"]},{"url":"https://github.com/tidyverse/readxl/issues/441","tags":["web"]},{"url":"https://github.com/tidyverse/readxl/pull/442","tags":["web"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0404","tags":["web"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0426","tags":["web"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0460","tags":["web"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0461","tags":["web"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0462","tags":["web"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0463","tags":["web"]},{"url":"https://github.com/evanmiller/libxls/issues/34","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-2896","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2896","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-2896","description":"An exploitable out-of-bounds write vulnerability exists in the xls_mergedCells function of libxls 1.4. . A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.","status":"published","published":"2017-11-20T22:00:00Z","modified":"2024-09-16T23:50:50.374Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:33:15.543086Z"}],"euvd":[{"id":"EUVD-2017-12037","description":"An exploitable out-of-bounds write vulnerability exists in the xls_mergedCells function of libxls 1.4. . A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.","status":"published","published":"2017-11-20T22:00:00Z","modified":"2024-09-16T23:50:50Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:29:04.923307Z"}],"ghsa":[{"id":"GHSA-rpv6-jf42-c65x","title":"An exploitable out-of-bounds write vulnerability exists in the xls_mergedCells function of libxls...","description":"An exploitable out-of-bounds write vulnerability exists in the xls_mergedCells function of libxls 1.4. . A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.","status":"published","published":"2022-05-13T01:01:15Z","modified":"2023-02-01T05:02:25Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:49:54.32219Z"}],"nvd":[{"id":"CVE-2017-2896","description":"An exploitable out-of-bounds write vulnerability exists in the xls_mergedCells function of libxls 1.4. . A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.","status":"published","published":"2017-11-20T22:29:00.293Z","modified":"2026-06-17T01:17:05.24Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:04:09.7374Z"}],"osv":[{"id":"CVE-2017-2896","description":"An exploitable out-of-bounds write vulnerability exists in the xls_mergedCells function of libxls 1.4. . A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.","status":"published","published":"2017-11-20T22:29:00.293Z","modified":"2026-10-24T10:30:29.320606143Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"DEBIAN-CVE-2017-2896","description":"An exploitable out-of-bounds write vulnerability exists in the xls_mergedCells function of libxls 1.4. . A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.","status":"published","published":"2017-11-20T22:29:00.293Z","modified":"2026-09-01T20:03:47.919329598Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"UBUNTU-CVE-2017-2896","description":"An exploitable out-of-bounds write vulnerability exists in the xls_mergedCells function of libxls 1.4. . A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.","status":"published","published":"2017-11-20T22:29:00Z","modified":"2025-10-24T04:46:06Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"DSA-4173-1","title":"r-cran-readxl - security update","status":"published","published":"2018-04-16T00:00:00Z","modified":"2026-03-09T01:22:13.025927Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"RSEC-2023-0","title":"Out-of-bounds write and stack based buffer overflow vulnerabilities","description":"The readxl R package, versions 0.1.0 to 1.0.0, is vulnerable to multiple attack vectors due to the underlying use  of the libxls library. Several exploitable vulnerabilities have been identified in different functions of libxls versions 1.3.4 and 1.4. These include out-of-bounds write and stack based buffer overflow vulnerabilities in the xls_mergedCells and xls_getfcell functions respectively. Furthermore, integer overflow vulnerabilities exist in the xls_preparseWorkSheet and xls_appendSST functions when handling MULBLANK, MULRK records and a shared string table (SST). An additional out-of-bounds vulnerability has been identified in the xls_addCell function when it processes a formula record. All these vulnerabilities can lead to memory corruption, potentially resulting in remote code execution. The exploit is triggered when a specially crafted XLS file, possibly sent by an attacker, is processed by these vulnerable functions.","status":"published","published":"2023-07-13T02:22:58.6Z","modified":"2025-05-19T19:43:47.107116Z","updated_at":"2026-11-02T15:53:39.492624Z"}]}}