CVE-2026-41034

Untrusted Pointer Dereference in ONLYOFFICE DocumentServer XLS Processing Causes Information Leak and ASLR Bypass

Published Apr 16, 2026 CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Description

ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via pictFmla.cbBufInCtlStm and other vectors), leading to an information leak and ASLR bypass.

Analysis

Technical impact

The vulnerability is an untrusted pointer dereference that occurs during XLS processing and conversion in ONLYOFFICE DocumentServer. This flaw allows attackers to read memory contents (information leak) and bypass Address Space Layout Randomization, potentially aiding further exploitation. It is a classic memory safety error marked as CWE‑125.

Affected Systems

VERSIONS PRIOR TO 9.3.0 of Ascensio ONLYOFFICE DocumentServer are affected. The issue is present in the document conversion component handling XLS files.

Risk and Exploitability

The CVSS score of 5 denotes moderate severity, while the lack of an EPSS score means current exploitation probability is unknown. The weakness does not require local privilege escalation; an attacker only needs to supply a crafted XLS file to the server. Because the flaw can subvert ASLR, attackers that discover it may combine it with other remote exploits. The vulnerability is not listed in the CISA KEV catalog.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Ascensio

ONLYOFFICE DocumentServer

unaffected

Version	Status	Constraints
`0`	affected	< 9.3.0

No data.

Vendor Product Versions

Onlyoffice

Document Server

Version	Status	Scheme	Platform
`[0,9.3.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade ONLYOFFICE DocumentServer to 9.3.0 or later.
If an upgrade is not immediately possible, block or disable XLS file uploads or the conversion feature to prevent exploitation.
Implement input validation for XLS files and perform strict bounds checking to eliminate untrusted pointer dereferences, following secure coding practices.

Generated by OpenCVE AI on April 16, 2026 at 08:52 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.306% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md

History

Apr 16, 2026 1:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 16, 2026 9:15 AM Title updated. First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
Title		Untrusted Pointer Dereference in ONLYOFFICE DocumentServer XLS Processing Causes Information Leak and ASLR Bypass
First Time appeared		Onlyoffice Onlyoffice document Server
Vendors & Products		Onlyoffice Onlyoffice document Server

Apr 16, 2026 6:30 AM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via pictFmla.cbBufInCtlStm and other vectors), leading to an information leak and ASLR bypass.
Weaknesses		CWE-125
References		https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md
Metrics		cvssV3_1 `{'score': 5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N'}`