Pawlos

**Name of the Vulnerable Software and Affected Versions** OpenMcdf (affected versions not specified) **Description** OpenMcdf fails to detect cycles in the directory entry red-black tree of a Compound File Binary (CFB) document. A crafted CFB file containing a cycle in the `LeftSiblingID` or `RightSiblingID` chain causes the software to loop indefinitely, leading to a denial of service. This occurs because the `DirectoryTreeEnumerator` and `DirectoryTree.TryGetDirectoryEntry` traverse the tree without tracking visited node IDs. Two specific code paths are affected: 1. The `Storage.EnumerateEntries()` function, where `DirectoryTreeEnumerator.MoveNext()` never returns false, causing the caller's loop to never exit and the heap to grow unboundedly. 2. The `Storage.OpenStream()` function, where `DirectoryTree.TryGetDirectoryEntry` loops indefinitely within `DirectoryEntries.TryGetSibling` during name lookup. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Scriban versions prior to 7.0.0 **Description** An issue exists in the parsing of nested array initializers where deeply nested structures cause recursion through the path (ParseArrayInitializer → ParseExpression → ParseArrayInitializer). This specific path is not monitored by the `ExpressionDepthLimit` counter. An attacker providing untrusted input to the `Template.Parse` function can trigger an uncatchable `StackOverflowException`, which results in the immediate termination of the process. **Recommendations** Update Scriban to version 7.0.0 or later.