CVE-2026-110600 Details

A NULL pointer dereference vulnerability has been identified in xlsxio versions through 0.2.37. The issue arises in the worksheet relationship parser within the file 'lib/xlsxio_read.c', specifically in the function 'main_sheet_get_sheetfile_expat_callback_element_start()'. This vulnerability allows attackers to crash applications by using crafted .xlsx files. The exploit involves supplying a workbook.xml.rels file that contains a worksheet relationship missing an Id attribute. When the function 'xlsxioread_sheet_open()' is called, the process crashes due to the NULL dereference.

To address this vulnerability, xlsxio should be updated to version 0.2.38 or later, where the issue has been fixed. Users can also apply a manual patch by adding a NULL check for the 'Id' attribute in the 'main_sheet_get_sheetfile_expat_callback_element_start()' function before comparing it to the 'sheetrelid'.