Description

An out-of-bounds read vulnerability exists in the xls_dumpSummary() function of libxls 1.6.3 due to insufficient validation of file-controlled OLE summary offsets.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-10T21:17:47.047Z",
  "pubdate": "2026-09-10T21:17:47.047Z",
  "executiveSummary": "An out-of-bounds read vulnerability has been identified in the xls_dumpSummary() function within libxls version 1.6.3. This vulnerability stems from improper validation of OLE summary offsets that are directly controlled by the input file structure.\nThe flaw allows an attacker to provide a maliciously crafted Excel file to trigger an out-of-bounds memory read. If successfully exploited, this vulnerability could lead to information disclosure, where sensitive data residing in the process memory space may be leaked to the attacker, or potentially result in an application crash, leading to a denial-of-service condition.\nThe vulnerability affects users of libxls 1.6.3 and any downstream applications that incorporate this library for parsing Excel files. Exploitation does not require prior authentication, as the attack is typically triggered upon the parsing of a specifically crafted document provided to the application. Given that libxls is often integrated into automated systems, file converters, or data processing pipelines, the risk is significant for environments that ingest untrusted user-supplied files.",
  "technicalDetails": "The root cause of the vulnerability resides in the xls_dumpSummary() function in libxls 1.6.3. During the parsing of OLE (Object Linking and Embedding) summary information, the library attempts to process metadata offsets retrieved from the file itself.\nThe vulnerability occurs because the library fails to sufficiently validate these file-controlled offsets against the actual allocated memory buffers before performing read operations. Specifically, the offsets are used as indices or pointers to access data structures representing the OLE summary properties. Because these offsets are not checked for bounds, an attacker can supply an out-of-range value that causes the pointer arithmetic to reference memory addresses outside of the legitimate buffer boundaries.\nThe attack flow begins when an application utilizing libxls processes a maliciously crafted Excel file. When the parser reaches the OLE summary section, the xls_dumpSummary() function extracts the user-supplied offsets. Without proper bounds checking, the application attempts to read from these invalid addresses. If the memory at the calculated address is readable, the contents are processed or potentially output, leading to an information disclosure vulnerability. If the read operation targets an unmapped or prohibited memory region, the process will trigger a segmentation fault, causing an application crash.\nThis vulnerability is classified as an out-of-bounds read (CWE-125). Exploitation is possible without authentication, as the primary vector is the passive parsing of an untrusted file. The vulnerability does not inherently allow for remote code execution, but it effectively compromises the confidentiality of the memory space associated with the libxls-linked process. Attackers can leverage this to leak pointers or sensitive data, which might then be used in chained exploits to bypass security mitigations such as ASLR. The library does not enforce privilege restrictions on the file processing, meaning any process with sufficient privileges to read the malicious file is susceptible to the crash or memory leak."
}