---
id: CVE-2026-26824
title: >-
  libxls through version 1.6.3 contains a use of uninitialized memory
  vulnerability in the OLE container parser
summary: >-
  libxls through version 1.6.3 contains a use of uninitialized memory
  vulnerability in the OLE container parser. Memory allocated for the Master
  Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before
  being consumed b…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L'
cwe:
  - CWE-457
vendor: libxls_project
product: libxls
affected:
  - libxls <= 1.6.3
published: '2026-06-03'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T16:16:42.363'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-26824'
references:
  - url: >-
      https://github.com/libxls/libxls/commit/9adebc9b6d60db21f25ddc898e8760eeb69d6529
    label: cve@mitre.org
  - url: 'https://github.com/libxls/libxls/issues/153'
    label: cve@mitre.org
  - url: 'https://github.com/libxls/libxls/issues/155'
    label: cve@mitre.org
  - url: 'https://github.com/libxls/libxls/issues/155'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-06-04T12:24:54.677514Z'
epss: 0.00453
epssPercentile: 0.36714
ingestedAt: '2026-09-23T16:27:22.623Z'
---

## Overview

libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before being consumed by ole2_validate_sector_chain(), which may result in application crashes or potential information disclosure when processing a crafted XLS file

## Affected

- `libxls <= 1.6.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.