A use‑of‑uninitialized memory flaw exists in libxls 1.6.3 when it parses malformed XLS files via xls_parseWorkBook(). The bug originates from uninitialized heap memory produced by the OLE layer ole2_read and can cause undefined behavior, incorrect parsing logic, or potentially leak sensitive information. The vulnerability is detectable with MemorySanitizer and can lead to application crashes or data exposure if left unaddressed.

The affected product is the libxls open‑source library, specifically version 1.6.3. No other vendor or product variants are listed. Systems that embed libxls 1.6.3 and process XLS files from untrusted sources are potentially impacted.

No CVSS score or EPSS value is available for this entry, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is triggered by malformed input files parsed by the library, the likely attack vector is local or remote delivery of a crafted XLS file to an application that utilizes libxls. While the absence of exploitation metrics makes a precise risk assessment difficult, the possibility of information disclosure and unstable parsing logic warrants precautionary measures.