CVE-2026-3664: Xlnt Buffer Overflow Vulnerability

CVE-2026-3664 Overview

A vulnerability has been identified in xlnt-community xlnt up to version 1.6.1. The issue affects the function xlnt::detail::compound_document::read_directory within the file source/detail/cryptography/compound_document.cpp of the Encrypted XLSX File Parser component. Exploitation of this vulnerability through manipulation of crafted input can lead to an out-of-bounds read condition. This vulnerability requires local access to exploit and the exploit details have been publicly disclosed.

Critical Impact
An attacker with local access can trigger an out-of-bounds read in the xlnt library's encrypted XLSX file parsing functionality, potentially causing application crashes or information disclosure from adjacent memory regions.

Affected Products

xlnt-community xlnt versions up to and including 1.6.1
Applications utilizing the xlnt library for encrypted XLSX file processing
Software incorporating the compound document cryptography module

Discovery Timeline

2026-03-07 - CVE CVE-2026-3664 published to NVD
2026-03-10 - Last updated in NVD database

Technical Details for CVE-2026-3664

Vulnerability Analysis

This vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The flaw resides in the encrypted XLSX file parsing component, specifically within the compound document handling code. When processing malformed or specially crafted encrypted XLSX files, the read_directory function fails to properly validate buffer boundaries before reading data.

The vulnerability occurs in the cryptography subsystem where compound documents are parsed. The affected function processes directory entries from encrypted XLSX files without adequate bounds checking, allowing reads beyond allocated memory regions. This can result in application instability, crashes, or potential exposure of sensitive data from adjacent memory.

Root Cause

The root cause stems from insufficient boundary validation in the xlnt::detail::compound_document::read_directory function located in source/detail/cryptography/compound_document.cpp. When parsing directory structures within encrypted XLSX files, the function does not properly verify that read operations stay within the allocated buffer boundaries. This oversight allows specially crafted input to trigger reads past the end of the intended memory region.

Attack Vector

The attack requires local access to execute. An attacker must craft a malicious encrypted XLSX file and have it processed by an application using the vulnerable xlnt library. The exploitation scenario typically involves:

Creating a specially crafted encrypted XLSX file with malformed compound document structures
Having the target application or library process the malicious file
Triggering the out-of-bounds read when the read_directory function parses the crafted input

The vulnerability has been publicly disclosed with proof-of-concept materials available. Technical details can be found in the GitHub PoC Repository and the GitHub Issue #141 tracking this vulnerability.

Detection Methods for CVE-2026-3664

Indicators of Compromise

Unexpected application crashes when processing encrypted XLSX files
Abnormal memory access patterns in applications using the xlnt library
Unusual XLSX files with malformed compound document structures being processed
Application logs indicating memory access violations in cryptography-related functions

Detection Strategies

Monitor applications using xlnt library for crashes or abnormal terminations during file processing
Implement file validation to identify malformed encrypted XLSX files before processing
Deploy runtime memory protection tools to detect out-of-bounds memory access attempts
Review application logs for errors related to compound document parsing failures

Monitoring Recommendations

Enable verbose logging for applications processing XLSX files with the xlnt library
Monitor system stability metrics for applications handling encrypted documents
Implement alerting for memory access violations in production environments
Track xlnt library versions in use across the environment for vulnerability management

How to Mitigate CVE-2026-3664

Immediate Actions Required

Update xlnt library to the patched version incorporating Pull Request #147
Audit applications to identify all instances of xlnt library usage
Implement input validation for XLSX files before processing with vulnerable library versions
Consider restricting encrypted XLSX file processing from untrusted sources until patched

Patch Information

The fix for this vulnerability is available in Pull Request #147 on the xlnt-community GitHub repository. Users are strongly advised to apply this patch to resolve the out-of-bounds read vulnerability. For detailed tracking information, refer to GitHub Issue #141 and the VulDB entry #349553.

Workarounds

Restrict processing of encrypted XLSX files to trusted sources only until the patch is applied
Implement additional input validation layers to verify XLSX file integrity before processing
Deploy the application in sandboxed environments to limit potential impact of exploitation
Consider alternative libraries for encrypted XLSX processing if immediate patching is not feasible

bash

# Example: Update xlnt library from source with patch applied
git clone https://github.com/xlnt-community/xlnt.git
cd xlnt
git fetch origin pull/147/head:patch-147
git checkout patch-147
mkdir build && cd build
cmake ..
make && make install