OpenMcdf, a .NET library for manipulating Compound File Binary files, contains a flaw where it does not detect cycles in its directory entry red‑black tree. A crafted CFB file that includes a cycle in the LeftSiblingID / RightSiblingID chain causes the library’s Storage.EnumerateEntries() and Storage.OpenStream() methods to spin in an infinite loop. This consumes the calling thread’s CPU and memory resources with no recovery path, resulting in a denial of service.

Affected systems are applications that integrate the Ironfede OpenMcdf library versions earlier than 3.1.3. The library is distributed by Ironfede and can be found in the open‑source repository. Any .NET or C# component that loads or parses CFB documents using the old OpenMcdf code is vulnerable until it is updated to 3.1.3 or later.

The CVSS score of 6.2 indicates moderate severity. Because the exploit requires an attacker to supply a malicious CFB file to a code path that uses OpenMcdf, it is considered a local or application‑level attack vector, inferred from the library’s usage context. The EPSS score is not available, and the vulnerability is not listed in KEV, suggesting that while exploitation is feasible, it may not be actively used in the wild yet.