The defect resides in xlnt-community’s xlnt library, specifically in the Encrypted XLSX File Parser’s read_directory routine in compound_document.cpp. An attacker who can craft malicious input files can trigger a read that goes beyond the intended buffer boundaries. The result is not code execution or privilege escalation; instead it can expose data that resides in memory adjacent to the buffer. The flaw is a classic out‑of‑bounds read identified by CWE‑119 and CWE‑125.

All releases of xlnt up to and including version 1.6.1 are vulnerable. The issue is confined to the cryptography component that processes encrypted XLSX files. No later versions were mentioned, and the vulnerability is not present in releases newer than 1.6.1.

The CVSS score is 4.8, indicating moderate severity. EPSS is less than 1 %, suggesting a low probability of exploitation at the current time. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local execution, and the vulnerability has been publicly disclosed. Consequently, only users with local access to an application that uses xlnt are at risk.