CVE-2026-26825: Libxls Project Libxls

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reachable via xls_parseWorkBook() and is triggered by uninitialized heap memory originating from the OLE layer (ole2_read). The flaw is detectable with MemorySanitizer (MSAN) and can lead to undefined behavior, incorrect parsing logic, or potential information disclosure.

Affected products

Published 2026-06-03. Last modified 2026-09-23.