CVE-2026-79591

Heap Buffer Overflow and Use-After-Free in libxls xls_getCSS Function

View on CVE.org
Published Sep 10, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Description
A heap-buffer-overflow and use-after-free vulnerability exists in the xls_getCSS() function of libxls 1.6.3 due to insufficient validation of a file-controlled font index.

Analysis

AI-generated

Technical impact

A heap-buffer-overflow and use-after-free vulnerability exists in the xls_getCSS() function of libxls 1.6.3. The flaw stems from insufficient validation of a file-controlled font index, allowing a crafted XLS file to corrupt memory and potentially execute arbitrary code or crash the application. This weakness is identified as CWE-122.

Affected Systems

The vulnerability affects the libxls library. Any application that includes libxls 1.6.3 for parsing Excel (.xls) files is potentially exposed.

Risk and Exploitability

The flaw is triggered by processing a malicious XLS file, so the attack vector is likely local through a supplied spreadsheet. An attacker who can supply a specifically crafted file to the vulnerable process can exploit the buffer overflow and free denial to achieve arbitrary code execution. The EPSS score is <1%, it is not listed in CISA KEV, and the CVSS score of 7.8 indicates high severity.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade libxls to the latest released version that contains the patch (e.g., 1.6.4 or later).
  • If an immediate upgrade is not possible, apply the hotfix supplied in the GitHub pull request (#164) to the xls_getCSS function while running libxls under least privilege or within a sandbox to contain potential exploitation.
  • Restrict the processing of XLS files to low-privilege processes or sandboxed environments to limit the impact of a potential exploit.

Generated by OpenCVE AI on September 21, 2026 at 07:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Heap Buffer Overflow and Use-After-Free in libxls xls_getCSS Function
Type Values Removed Values Added
Title Heap Buffer Overflow and Use‑After‑Free in libxls xls_getCSS Function
Weaknesses CWE-416
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Libxls
Libxls libxls
Vendors & Products Libxls
Libxls libxls
Type Values Removed Values Added
Title Heap Buffer Overflow and Use‑After‑Free in libxls xls_getCSS Function
Weaknesses CWE-122
CWE-416
Type Values Removed Values Added
Description A heap-buffer-overflow and use-after-free vulnerability exists in the xls_getCSS() function of libxls 1.6.3 due to insufficient validation of a file-controlled font index.
References
Earlier changes (1)
Weaknesses
  • CWE-122

    Heap-based Buffer Overflow

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Sep 15, 2026, 2:11 PM
Reserved
Aug 25, 2026, 12:00 AM

View source JSON

Updated
Sep 15, 2026, 2:09 PM

JSON

Status
Deferred
Published
Sep 10, 2026, 9:17 PM
Modified
Sep 22, 2026, 8:00 PM

View source JSON

No data.

Updated
Sep 21, 2026, 7:45 AM

JSON