OpenMcdf is a .NET/C# library for manipulating Compound File Binary (CFB) files. In versions 3.1.3 and earlier, its DirectoryTree.TryGetDirectoryEntry routine contains a BST name‑lookup loop that iterates over directory entries by repeatedly calling directories.TryGetSibling(child, siblingType, validateColor). When a CFB file is crafted with cyclic left/right sibling links that satisfy the BST‑order check at every step, the loop, which has no cycle detection, runs indefinitely. This causes the host application to consume CPU resources endlessly and ultimately become unresponsive, resulting in a denial of service. The flaw is a classic infinite‑loop (CWE‑835) bug and is resolved in OpenMcdf version 3.1.4.

The issue affects the openmcdf library, versions 3.1.3 and earlier. The fix is available in version 3.1.4 and later releases of the library.

The CVSS score of 6.2 indicates moderate severity, but the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit this by supplying a specially crafted CFB file to any application that uses OpenMcdf’s OpenStorage or OpenStream functions, leading to an unrecoverable denial of service. Based on the description, it is inferred that no additional authentication is required; the attack could be local or remote depending on the library exposure.