CVE-2026-26825: libxls Use-After-Free Vulnerability

CVE-2026-26825 Overview

CVE-2026-26825 is a use-of-uninitialized memory vulnerability in libxls version 1.6.3, an open-source library used to read Microsoft Excel (XLS) binary files. The flaw is triggered when the library parses a malformed XLS file. Specifically, uninitialized heap memory originates from the Object Linking and Embedding (OLE) layer in ole2_read and is later consumed by xls_parseWorkBook(). The condition is detectable using MemorySanitizer (MSAN) instrumentation. Consequences include undefined behavior, incorrect parsing logic, and potential information disclosure to attacker-controlled outputs.

Critical Impact

Processing an attacker-supplied XLS file with a vulnerable libxls build can leak uninitialized heap contents or produce undefined parsing behavior in any application that embeds the library.

Affected Products

• libxls 1.6.3
• Applications and services that statically or dynamically link libxls 1.6.3 to parse XLS files
• Document conversion, ingestion, and indexing pipelines that rely on libxls for legacy Excel format support

Discovery Timeline

• 2026-06-03 - CVE-2026-26825 published to NVD
• 2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-26825

Vulnerability Analysis

The vulnerability is classified as Uninitialized Memory Use [CWE-908]. It surfaces during the workbook parsing stage of libxls when handling a malformed XLS file. The OLE2 compound document reader (ole2_read) returns buffers whose contents are not fully initialized before being passed up to higher-level parsing routines. When xls_parseWorkBook() interprets these bytes as record headers, lengths, or content fields, it operates on heap memory whose values are not defined by the input file. The result is parser behavior that depends on stale heap contents rather than the attacker's input alone.

Root Cause

The root cause is missing initialization of heap-allocated buffers in the OLE2 layer of libxls. When a malformed XLS file does not supply the expected number of bytes for a stream or sector, ole2_read returns partially populated memory. The workbook parser does not validate that the OLE read fully populated the buffer before consuming it. MemorySanitizer reports the use of uninitialized values during xls_parseWorkBook() invocation paths.

Attack Vector

An attacker crafts a malformed XLS document and delivers it to any application that parses XLS files using libxls 1.6.3. When the target opens the file, the OLE layer returns uninitialized memory that flows into workbook parsing. Depending on how the host application surfaces parsed values, an attacker may influence parsing decisions or coerce the application into disclosing residual heap contents through generated output, logs, or converted documents. Refer to the GitHub Issue Report for reproducer details.

Detection Methods for CVE-2026-26825

Indicators of Compromise

• Crashes, sanitizer reports, or anomalous output from processes that parse XLS files using libxls 1.6.3
• MemorySanitizer (MSAN) warnings referencing xls_parseWorkBook or ole2_read in stack traces
• Malformed XLS files appearing in document ingestion queues, mail attachments, or upload endpoints

Detection Strategies

• Run libxls-linked binaries under MemorySanitizer in pre-production to surface uninitialized reads originating from ole2_read
• Inspect software bills of materials (SBOMs) for the libxls 1.6.3 component across servers, containers, and developer workstations
• Monitor parser worker processes for unexpected exits, hangs, or output containing non-printable byte sequences that suggest leaked heap data

Monitoring Recommendations

• Log and alert on parser process crashes correlated with recently received XLS attachments
• Capture file hashes for all XLS files entering document processing pipelines for retrospective hunting once detection signatures are available
• Track outbound responses from services that return parsed XLS content for anomalous size or entropy that could indicate information disclosure

How to Mitigate CVE-2026-26825

Immediate Actions Required

• Identify every application and container image that bundles libxls 1.6.3 and prioritize internet-facing parsers first
• Restrict acceptance of XLS files at network and application boundaries until a fixed build is deployed
• Sandbox XLS parsing workloads using process isolation, seccomp, or container resource limits to contain undefined behavior

Patch Information

At the time of publication, no fixed libxls release is referenced in the NVD entry. Track the upstream project for a remediated version and review the GitHub Issue Report for the current status of a fix. Once a patched release is available, rebuild and redeploy all dependent binaries and container images.

Workarounds

• Disable XLS parsing features in applications that do not require legacy Excel binary format support
• Convert incoming XLS files to XLSX using a hardened, isolated converter before passing data to libxls-dependent components
• Apply a local patch that zero-initializes OLE read buffers prior to use in xls_parseWorkBook() if maintaining an in-house fork