CVE-2026-26824: libxls Information Disclosure Vulnerability

CVE-2026-26824 Overview

CVE-2026-26824 is a use of uninitialized memory vulnerability [CWE-908] affecting libxls through version 1.6.3. The flaw exists in the OLE container parser, specifically in how the read_MSAT() function handles memory allocated for the Master Sector Allocation Table (MSAT). Memory is not fully initialized before being consumed by ole2_validate_sector_chain(), which can lead to application crashes or potential information disclosure when a crafted XLS file is processed.

Critical Impact

Attackers can trigger denial of service or leak sensitive memory contents by supplying a malicious XLS file to any application that uses libxls for spreadsheet parsing.

Affected Products

• libxls versions up to and including 1.6.3
• Applications and libraries that embed libxls for XLS file parsing
• Document processing pipelines and converters relying on libxls

Discovery Timeline

• 2026-06-03 - CVE-2026-26824 published to NVD
• 2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-26824

Vulnerability Analysis

The vulnerability resides in the OLE2 (Object Linking and Embedding) container parser used by libxls to read legacy XLS spreadsheet files. The read_MSAT() function allocates a buffer for the Master Sector Allocation Table but fails to fully initialize the allocated memory region. When ole2_validate_sector_chain() later consumes this buffer, it operates on stale heap or stack data left over from prior allocations.

Processing a crafted XLS file triggers reads against uninitialized bytes during sector chain validation. Depending on the surrounding memory contents, this produces inconsistent control flow, segmentation faults, or leakage of residual process memory into error paths or output buffers.

Root Cause

The root cause is missing zero-initialization of the MSAT buffer after allocation in read_MSAT(). The OLE2 format permits sparsely populated MSAT entries, so any sector slot not explicitly written by the parser retains uninitialized values. Subsequent validation routines treat those values as legitimate sector indices, violating the assumption that allocated memory begins in a known state.

Attack Vector

Exploitation requires the victim to open or process a malicious XLS file with an application backed by libxls. The attacker controls the OLE container layout and chooses MSAT sizes that maximize the uninitialized region exposed to ole2_validate_sector_chain(). Resulting outcomes include application crashes (denial of service) and, in worst cases, disclosure of adjacent heap memory containing sensitive runtime data.

The vulnerability mechanism is described in the upstream libxls GitHub issue tracker. No verified public proof-of-concept code is published at this time.

Detection Methods for CVE-2026-26824

Indicators of Compromise

• Repeated crashes or abnormal terminations in processes that parse XLS files through libxls
• XLS files with unusually large or malformed OLE Master Sector Allocation Table structures
• Memory sanitizer (MSan, Valgrind) reports flagging uninitialized reads inside read_MSAT() or ole2_validate_sector_chain()

Detection Strategies

• Run libxls-based pipelines under AddressSanitizer or MemorySanitizer in staging to identify uninitialized read paths
• Inspect crash dumps from document conversion services for stack frames referencing OLE2 sector validation
• Apply file-format inspection at ingest points to flag XLS files with anomalous MSAT sector counts

Monitoring Recommendations

• Monitor document parsing services for elevated crash rates and unexpected restart loops
• Log file hashes and origins of XLS files that trigger parser failures for retrospective analysis
• Track libxls library versions across the fleet to identify hosts still running 1.6.3 or earlier

How to Mitigate CVE-2026-26824

Immediate Actions Required

• Inventory all applications, services, and containers that link against libxls 1.6.3 or earlier
• Restrict acceptance of XLS files from untrusted sources at ingress boundaries
• Sandbox or isolate document parsing workloads to contain crashes and limit information disclosure

Patch Information

No official patched release is referenced in the current NVD data. Monitor the libxls GitHub issue tracker for upstream fixes. When a patched version becomes available, ensure the MSAT buffer is zero-initialized after allocation in read_MSAT() before any consumer reads from it.

Workarounds

• Convert legacy XLS files to XLSX using a hardened, non-libxls parser before downstream processing
• Rebuild libxls locally with a patch that calls calloc() or explicit memset() on the MSAT allocation
• Run XLS parsing in low-privilege, ephemeral containers with seccomp restrictions to minimize impact of crashes or memory leaks

# Configuration example: identify hosts using vulnerable libxls
find / -name 'libxlsreader*' -o -name 'libxls.so*' 2>/dev/null
ldconfig -p | grep -i libxls
dpkg -l | grep -i libxls || rpm -qa | grep -i libxls