Spreadsheet File Handling Vulnerability in HCL BigFix Service Management

CVE-2025-31978

What is CVE-2025-31978?

HCL BigFix Service Management exhibits a critical security gap in how it processes spreadsheet files, including CSV, XLS, and XLSX formats. The software fails to adequately sanitize or securely render these files before processing or distributing them. This flaw could enable an attacker to inject malicious content into data fields, risking information exfiltration or other forms of malicious exploitation when these files are executed in spreadsheet software. Although modern versions of Excel alert users about untrusted content, the inherent risk remains if such files are executed without scrutiny.

References