CVE-2026-111126 Details
Description
catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of process_item() in src/xlsparse.c that allows attackers to read past the static rec buffer via a crafted end column. Attackers can supply a crafted .xls workbook or BIFF stream with a large endcol to xls2csv to disclose adjacent process memory as CSV cells or crash the process.
A memory safety vulnerability allowing out-of-bounds reads has been identified in Catdoc versions through 0.95. This issue arises in the MULRK record handler of the 'xls2csv' Excel parser, specifically within the 'process_item()' function of 'src/xlsparse.c'. The vulnerability allows attackers to read beyond a static buffer by supplying a crafted .xls workbook or BIFF stream with a large end column value. Exploitation of this vulnerability can lead to the disclosure of adjacent process memory, which is output as CSV cell values, or cause the process to crash.
Users can update to Catdoc version 0.96 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| catdoc | <= 0.95 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |