CVE-2026-79592 Details

A vulnerability allowing out-of-bounds read has been identified in libxls version 1.6.3. This issue arises in the xls_dumpSummary() function, where the parsing of OLE summary property sets is controlled by file-derived offsets that are not properly validated. As a result, a crafted file can manipulate these offsets to point outside the allocated summary buffer, leading to a segmentation fault and potential information leakage.

Offsets in the summary property sets should be validated against the actual size of the summary buffer before being dereferenced. Additionally, the number of properties in the section header should be checked against the section size to prevent out-of-bounds access.