PT-2026-23859

CVE-2026-3663

Published

2026-03-07

Updated

2026-03-10

Description by

CVSS 3.1

7.1

High

MetricsAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions xlnt versions up to 1.6.1

Description A flaw exists within the xlnt library, specifically in the XLSX File Parser component. This issue resides in the xlnt::detail::compound document istreambuf::xsgetn function within the source/detail/cryptography/compound document.cpp file. A manipulation of the file can lead to an out-of-bounds read, and the exploit has been publicly disclosed. The issue is only exploitable with local access.

Recommendations Apply patch 147 to resolve this issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-125: Out-of-bounds Read

Related identifiers