Description
xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in main_sheet_get_sheetfile_expat_callback_element_start() in lib/xlsxio_read.c that allows attackers to crash applications via crafted files. Attackers can supply a .xlsx file whose workbook.xml.rels contains a worksheet Relationship lacking an Id attribute, crashing the process when xlsxioread_sheet_open() is called.
Published: 2026-10-14
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

A null pointer dereference occurs in the main_sheet_get_sheetfile_expat_callback_element_start function of the xlsxio library. The vulnerability is triggered when an attacker supplies a .xlsx file whose workbook.xml.rels contains a worksheet Relationship entry that lacks an Id attribute; the library then dereferences a NULL pointer during the sheet opening process, causing the application to crash. This flaw leads to a denial‑of‑service condition for the affected process and can disrupt user experience or services that rely on Excel file processing.

Affected Systems

The vulnerability affects the xlsxio library distributed by brechtsanders. Versions up to and including 0.2.37 are vulnerable; users of 0.2.38 or newer are not impacted.

Risk and Exploitability

The CVSS score of 6.8 indicates a moderate impact. An EPSS score of < 1% shows that the likelihood of this vulnerability being actively exploited in the wild is low. The flaw is exploitable remotely by providing a crafted .xlsx file that contains a Relationship element without an Id attribute; any party that can influence file uploads to a system using xlsxio can trigger the crash. This vulnerability is not listed in the CISA KEV catalog, and while it does not grant code execution or data exfiltration, it can be leveraged to deny service.

Generated by OpenCVE AI on October 15, 2026 at 21:33 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade xlsxio to a version newer than 0.2.37 that contains the fix
  • If an upgrade cannot be performed immediately, isolate the processing of untrusted .xlsx files by running xlsxio in a sandbox or separate process to limit damage
  • Validate workbook.xml.rels files before processing, ensuring each Relationship element includes an Id attribute; if missing, reject the file or manually patch the source by adding a NULL check

Generated by OpenCVE AI on October 15, 2026 at 21:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in main_sheet_get_sheetfile_expat_callback_element_start() in lib/xlsxio_read.c that allows attackers to crash applications via crafted files. Attackers can supply a .xlsx file whose workbook.xml.rels contains a worksheet Relationship lacking an Id attribute, crashing the process when xlsxioread_sheet_open() is called.
Title xlsxio through 0.2.37 NULL Pointer Dereference via Worksheet Relationship Without Id
First Time appeared Xlsxio Project
Xlsxio Project xlsxio
Weaknesses CWE-476
CPEs cpe:2.3:a:xlsxio_project:xlsxio:*:*:*:*:*:*:*:*
Vendors & Products Xlsxio Project
Xlsxio Project xlsxio
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Xlsxio Project Xlsxio
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-14T20:43:54.196Z

Reserved: 2026-10-14T13:07:20.207Z

Link: CVE-2026-110600

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-14T15:17:11.387

Modified: 2026-10-15T14:47:05.720

Link: CVE-2026-110600

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T11:00:07Z

Weaknesses