An out‑of‑bounds read occurs in the copy_unicode_string() function of catdoc when parsing certain .xls records. The function trusts a length field that can be set to 0xFFFF by an attacker, allowing the routine to read past the allocated buffer. This memory disclosure can leak data adjacent to the buffer or cause a process crash if the read goes beyond accessible memory.

Catdoc versions up to and including 0.95 are affected. Users of Catdoc 0.95 or earlier on any operating system that rely on the xls2csv command to process spreadsheet files are at risk.

With a CVSS score of 6.9 the vulnerability presents moderate severity. The EPSS score is below 1%, indicating a low likelihood of widespread exploitation, and it is not listed in CISA’s KEV catalog. Attackers can deliver a malicious .xls file containing 0xFFFF two‑byte characters in LABEL, STRING, or SST records. When xls2csv processes such a file, the unchecked string length can cause an out‑of‑bounds read, exposing adjacent memory to the attacker or crashing the process. The attack vector is typically local or remote via a file‑processing flow, depending on how the tool is used in the environment.