A flaw in the xlnt Excel XLSX parser allows a local user to trigger an out‑of‑bounds read in the compound_document_istreambuf::xsgetn function. The vulnerability is triggered by supplying a specially crafted input file, and it results in reading memory beyond the intended buffer boundaries. This can expose sensitive data stored in adjacent memory, potentially leading to information disclosure. The flaw is classified as a buffer overread (CWE‑119 and CWE‑125).

The xlnt‑community xlnt library, versions up to and including 1.6.1, is affected. Users integrating this library in any application that parses XLSX files may be vulnerable if they have local file access to the target system. No specific operating system or platform constraints are reported, so the impact is applicable wherever the vulnerable library is deployed.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score of less than 1% suggests a very low probability of exploitation in the wild at present. The vulnerability is not listed in the CISA KEV catalogue, further indicating limited exploitation evidence. The attack requires local access, which limits the threat surface but still poses risk to environments where the library handles untrusted input locally.