CVE-2026-26824
Medium · 6.5CVSS
6.5
EPSS
0.5%
Published
Jun 3, 2026
CISA due date
—
The record
libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before being consumed by ole2_validate_sector_chain(), which may result in application crashes or potential information disclosure when processing a crafted XLS file
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-112898 Pillow is a Python imaging library. CWE-457
- CVE-2026-112893 Pillow is a Python imaging library. CWE-457
- CVE-2026-109828 A vulnerability was found in libsndfile up to 1.2.2. CWE-457
- CVE-2026-84391 A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through… CWE-457
- CVE-2026-84639 Triggering an error condition in certain MIME bodies would cause uninitialized memory to… CWE-457
- CVE-2026-78935 Use of uninitialized variable in Mobile in Google Chrome on on iOS prior to 152.0.7977.65… CWE-457
- CVE-2026-62986 OpenEXR is the reference implementation and specification for the EXR image file format… CWE-457
- CVE-2026-76919 ESS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of… CWE-457