Heap-buffer-overflow and use-after-free vulnerabilities in the xls_getCSS() function of libxls 1.6.3 can corrupt memory when processing a malformed or malicious spreadsheet file. This can lead to unpredictable behavior, including the execution of arbitrary code or application crashes. The weakness arises from insufficient validation of a file‑controlled font index, representing a classic heap-based buffer overflow and use-after‑free condition (CWE‑122/CWE‑416).

The vulnerability affects the libxls library,3. Applications that use this version to parse Excel (.xls) files are potentially exposed.

A local file attack vector is likely, as the flaw is triggered by processing a crafted XLS file. Because the overflow and free violation can be leveraged to inject malicious code, the risk could be high for any process running the vulnerable library with elevated privileges. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA KEV. Given the nature of the bug, a high severity level is expected even though a CVSS score is not published.