CVE-2026-111127

EUVD-2026-102358
catdoc through 0.95 contains an out-of-bounds read vulnerability in copy_unicode_string() in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count. Attackers can supply a crafted .xls file declaring 0xFFFF two-byte characters in LABEL, STRING, or SST records to disclose adjacent memory through xls2csv output or crash the process.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.1 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
catdoc_projectcatdoc
𝑥
≤ 0.95
CNA
Debian logo
Debian Releases
Debian Product
Codename
catdoc
bookworm
undetermined
bookworm (security)
undetermined
forky
undetermined
sid
undetermined
trixie
undetermined
Common Weakness Enumeration
References
https://github.com/vbwagner/catdoc
https://github.com/vbwagner/catdoc/blob/38a2807d22ce1a08bc39b94e9072a9f8f52cd86f/src/xlsparse.c#L421-L520
https://hackmd.io/@haind-pwn/catdoc-xls-mulrk-endcol-and-string-count-oob-read
https://www.vulncheck.com/advisories/catdoc-through-0.95-out-of-bounds-read-via-xls2csv-copy-unicode-string