CVE-2026-3665: Xlnt-community Xlnt Use-After-Free Flaw

CVE-2026-3665 Overview

A null pointer dereference vulnerability was identified in xlnt-community xlnt versions up to 1.6.1. The affected element is the function xlnt::detail::xlsx_consumer::read_office_document within the file source/detail/serialization/xlsx_consumer.cpp of the XLSX File Parser component. Manipulation of crafted XLSX files leads to a null pointer dereference condition, which can cause an application crash and denial of service. The attack must be carried out locally, and the exploit is publicly available.

Critical Impact

Applications using the xlnt library to parse XLSX files are vulnerable to denial of service attacks through crafted malicious files that trigger a null pointer dereference during document parsing.

Affected Products

• xlnt-community xlnt versions up to 1.6.1

Discovery Timeline

• 2026-03-07 - CVE-2026-3665 published to NVD
• 2026-03-10 - Last updated in NVD database

Technical Details for CVE-2026-3665

Vulnerability Analysis

This vulnerability exists in the XLSX file parsing functionality of the xlnt library. The xlnt::detail::xlsx_consumer::read_office_document function fails to properly validate pointers before dereferencing them during the parsing of XLSX documents. When processing a specially crafted XLSX file, the parser may encounter unexpected data structures that result in a null pointer being accessed. This causes an immediate application crash, resulting in a denial of service condition.

The vulnerability requires local access to exploit, meaning an attacker would need to trick a user into opening a malicious XLSX file or have the ability to place malicious files where vulnerable applications might process them. While the availability impact is limited, it can disrupt services that rely on the xlnt library for spreadsheet processing.

Root Cause

The root cause of this vulnerability is improper resource management (CWE-404) in the XLSX parsing code. The read_office_document function does not adequately check for null pointer conditions before accessing memory. When the parser encounters malformed or unexpected data within an XLSX file structure, it attempts to dereference a pointer that has not been properly initialized or has been set to null, leading to the crash.

Attack Vector

The attack requires local access to execute. An attacker must craft a malicious XLSX file that triggers the null pointer condition during parsing. This could be accomplished through:

1. Sending a malicious XLSX file to a victim via email or file sharing
2. Placing the malicious file in a directory monitored by an automated process
3. Uploading the file to an application that processes user-submitted spreadsheets

When the vulnerable application opens or processes the crafted file, the null pointer dereference occurs in the xlnt::detail::xlsx_consumer::read_office_document function, causing the application to crash.

The vulnerability has been documented with a proof-of-concept available in the GitHub PoC Repository.

Detection Methods for CVE-2026-3665

Indicators of Compromise

• Unexpected application crashes when processing XLSX files
• Core dumps or crash reports referencing xlnt::detail::xlsx_consumer::read_office_document
• Presence of unusual or malformed XLSX files with unexpected internal structure
• Repeated denial of service conditions in spreadsheet processing services

Detection Strategies

• Monitor for application crashes with stack traces pointing to the xlnt library's XLSX parsing functions
• Implement file integrity monitoring to detect introduction of suspicious XLSX files
• Deploy endpoint detection solutions capable of identifying null pointer dereference exploitation attempts
• Review application logs for repeated failures during XLSX document parsing operations

Monitoring Recommendations

• Configure crash monitoring to alert on recurring failures in applications using the xlnt library
• Implement logging around XLSX file processing operations to capture file metadata before crashes
• Monitor for unusual volumes of XLSX file submissions that may indicate probing attacks
• Set up alerts for segmentation fault signals in processes utilizing xlnt functionality

How to Mitigate CVE-2026-3665

Immediate Actions Required

• Identify all applications and services using xlnt-community xlnt versions 1.6.1 and earlier
• Review the GitHub Issue Report for the latest remediation guidance
• Implement input validation for XLSX files before processing with the xlnt library
• Consider deploying application sandboxing to limit the impact of crashes

Patch Information

A fix for this vulnerability should be obtained from the xlnt-community project. Monitor the xlnt GitHub repository for updated releases that address this null pointer dereference issue. Refer to the GitHub Issue #140 for patch status and developer communications regarding the fix.

Workarounds

• Restrict processing of XLSX files from untrusted sources until a patch is available
• Implement file scanning and validation before passing files to the xlnt parser
• Run applications using xlnt in isolated environments or containers to contain crash impact
• Consider using alternative XLSX parsing libraries for critical applications until the vulnerability is patched
• Implement process restart mechanisms to maintain service availability in case of crashes

For additional technical details and vulnerability tracking, refer to the VulDB entry #349554.