CVE-2026-3664: Xlnt Buffer Overflow Vulnerability

CVE-2026-3664 Overview

A vulnerability has been identified in xlnt-community xlnt up to version 1.6.1. The issue affects the function xlnt::detail::compound_document::read_directory within the file source/detail/cryptography/compound_document.cpp of the Encrypted XLSX File Parser component. Exploitation of this vulnerability through manipulation of crafted input can lead to an out-of-bounds read condition. This vulnerability requires local access to exploit and the exploit details have been publicly disclosed.

Critical Impact

An attacker with local access can trigger an out-of-bounds read in the xlnt library's encrypted XLSX file parsing functionality, potentially causing application crashes or information disclosure from adjacent memory regions.

Affected Products

• xlnt-community xlnt versions up to and including 1.6.1
• Applications utilizing the xlnt library for encrypted XLSX file processing
• Software incorporating the compound document cryptography module

Discovery Timeline

• 2026-03-07 - CVE CVE-2026-3664 published to NVD
• 2026-03-10 - Last updated in NVD database

Technical Details for CVE-2026-3664

Vulnerability Analysis

This vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The flaw resides in the encrypted XLSX file parsing component, specifically within the compound document handling code. When processing malformed or specially crafted encrypted XLSX files, the read_directory function fails to properly validate buffer boundaries before reading data.

The vulnerability occurs in the cryptography subsystem where compound documents are parsed. The affected function processes directory entries from encrypted XLSX files without adequate bounds checking, allowing reads beyond allocated memory regions. This can result in application instability, crashes, or potential exposure of sensitive data from adjacent memory.

Root Cause

The root cause stems from insufficient boundary validation in the xlnt::detail::compound_document::read_directory function located in source/detail/cryptography/compound_document.cpp. When parsing directory structures within encrypted XLSX files, the function does not properly verify that read operations stay within the allocated buffer boundaries. This oversight allows specially crafted input to trigger reads past the end of the intended memory region.

Attack Vector

The attack requires local access to execute. An attacker must craft a malicious encrypted XLSX file and have it processed by an application using the vulnerable xlnt library. The exploitation scenario typically involves:

1. Creating a specially crafted encrypted XLSX file with malformed compound document structures
2. Having the target application or library process the malicious file
3. Triggering the out-of-bounds read when the read_directory function parses the crafted input

The vulnerability has been publicly disclosed with proof-of-concept materials available. Technical details can be found in the GitHub PoC Repository and the GitHub Issue #141 tracking this vulnerability.

Detection Methods for CVE-2026-3664

Indicators of Compromise

• Unexpected application crashes when processing encrypted XLSX files
• Abnormal memory access patterns in applications using the xlnt library
• Unusual XLSX files with malformed compound document structures being processed
• Application logs indicating memory access violations in cryptography-related functions

Detection Strategies

• Monitor applications using xlnt library for crashes or abnormal terminations during file processing
• Implement file validation to identify malformed encrypted XLSX files before processing
• Deploy runtime memory protection tools to detect out-of-bounds memory access attempts
• Review application logs for errors related to compound document parsing failures

Monitoring Recommendations

• Enable verbose logging for applications processing XLSX files with the xlnt library
• Monitor system stability metrics for applications handling encrypted documents
• Implement alerting for memory access violations in production environments
• Track xlnt library versions in use across the environment for vulnerability management

How to Mitigate CVE-2026-3664

Immediate Actions Required

• Update xlnt library to the patched version incorporating Pull Request #147
• Audit applications to identify all instances of xlnt library usage
• Implement input validation for XLSX files before processing with vulnerable library versions
• Consider restricting encrypted XLSX file processing from untrusted sources until patched

Patch Information

The fix for this vulnerability is available in Pull Request #147 on the xlnt-community GitHub repository. Users are strongly advised to apply this patch to resolve the out-of-bounds read vulnerability. For detailed tracking information, refer to GitHub Issue #141 and the VulDB entry #349553.

Workarounds

• Restrict processing of encrypted XLSX files to trusted sources only until the patch is applied
• Implement additional input validation layers to verify XLSX file integrity before processing
• Deploy the application in sandboxed environments to limit potential impact of exploitation
• Consider alternative libraries for encrypted XLSX processing if immediate patching is not feasible

# Example: Update xlnt library from source with patch applied
git clone https://github.com/xlnt-community/xlnt.git
cd xlnt
git fetch origin pull/147/head:patch-147
git checkout patch-147
mkdir build && cd build
cmake ..
make && make install