---
id: CVE-2026-26825
title: >-
  A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when
  parsing malformed XLS files
summary: >-
  A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when
  parsing malformed XLS files. The issue is reachable via xls_parseWorkBook()
  and is triggered by uninitialized heap memory originating from the OLE layer
  (ole2_read).…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-908
vendor: libxls_project
product: libxls
affected:
  - libxls = 1.6.3
published: '2026-06-03'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T16:16:42.607'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-26825'
references:
  - url: >-
      https://github.com/libxls/libxls/commit/9adf88f4e3b304e397f70ac189e70776edb6d5a3
    label: cve@mitre.org
  - url: 'https://github.com/libxls/libxls/issues/153'
    label: cve@mitre.org
  - url: 'https://github.com/libxls/libxls/issues/156'
    label: cve@mitre.org
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-06-08T16:41:53.848420Z'
epss: 0.00401
epssPercentile: 0.31523
ingestedAt: '2026-09-23T16:27:22.624Z'
---

## Overview

A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reachable via xls_parseWorkBook() and is triggered by uninitialized heap memory originating from the OLE layer (ole2_read). The flaw is detectable with MemorySanitizer (MSAN) and can lead to undefined behavior, incorrect parsing logic, or potential information disclosure.

## Affected

- `libxls = 1.6.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.