CVE-2026-41511 Details
Description
OpenMcdf is a fully .NET / C# library to manipulate Compound File Binary File Format files, also known as Structured Storage. Prior to version 3.1.3, OpenMcdf does not detect cycles in the directory entry red-black tree of a Compound File Binary (CFB) document. A crafted CFB file with a cycle in the LeftSiblingID / RightSiblingID chain causes Storage.EnumerateEntries() and Storage.OpenStream() to loop indefinitely, consuming the calling thread with no possibility of recovery via try/catch. This issue has been patched in version 3.1.3.
A denial-of-service vulnerability has been identified in OpenMcdf, a .NET library for manipulating Compound File Binary (CFB) files. Prior to version 3.1.3, OpenMcdf's directory traversal methods did not detect cycles in the red-black tree structure of CFB documents. This oversight allowed crafted CFB files with cyclical references in the directory entry chain to cause infinite loops in key library functions, such as 'Storage.EnumerateEntries()' and 'Storage.OpenStream()'. As a result, the affected thread could be consumed indefinitely, with no possibility of recovery through standard exception handling.
Users can upgrade to OpenMcdf version 3.1.3 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openmcdf/openmcdf/security/advisories/GHSA-jxpf-xq2m-q525 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/openmcdf/openmcdf/commit/24f445a557fc4f46461cf6d02d296cce16c293a0 | [email protected] | Patch |
| https://github.com/openmcdf/openmcdf/releases/tag/v3.1.3 | [email protected] | Release Notes |
| https://github.com/openmcdf/openmcdf/security/advisories/GHSA-jxpf-xq2m-q525 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openmcdf openmcdf | < 3.1.3 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | Reanalysis | [email protected] |
| Jun 1, 2026 | Initial Analysis | [email protected] |
| May 11, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | New CVE Received | [email protected] |