catdoc, a utility that extracts text from Microsoft Excel files, contains an out‑of‑bounds read in the MULRK record handler within the xls2csv component. A maliciously constructed .xls workbook or BIFF stream with an excessively large end column value allows the program to read memory beyond the intended buffer or crash, leaking sensitive data as CSV cells or triggering a denial of service. This flaw maps to CWE‑125, leading to a confidentiality impact.

Affected systems include installations of catdoc version 0.95 or earlier, released by fossies. The vulnerability exists in the xlsparse.c source used by the command‑line tool xls2csv, and applies to all builds and distributions that bundle catdoc <=0.95. The static rec buffer is read without bounds checking when processing the endcol field in a MULRK record.

The CVSS score is 6.9, indicating moderate severity. The EPSS score is less than 1 %, implying an extremely low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to supply a malicious Excel file or stream to the local xls2csv utility, so the attack vector is likely local execution or file‑based injection when the tool is run by an unprivileged user. Given the low EPSS, widespread exploitation is currently unlikely, but the potential for sensitive data exposure warrants prompt remediation.