Out-of-Bounds Read Vulnerability in catdoc Affected by Improper String Handling
CVE-2026-111127

6.9MEDIUM

Key Information:

Vendor

Catdoc

Status
Catdoc
Vendor
CVE Published:
15 October 2026

What is CVE-2026-111127?

The out-of-bounds read vulnerability in catdoc versions up to 0.95 occurs in the function copy_unicode_string within the file src/xlsparse.c. This flaw can be exploited when the application processes crafted .xls files that incorrectly declare 0xFFFF two-byte characters in LABEL, STRING, or SST records. Attackers can exploit this weakness to read beyond allocated buffers, potentially disclosing adjacent memory or causing the application to crash during the conversion of .xls files to CSV format via the xls2csv utility.

Affected Version(s)

catdoc 0 <= 0.95

References

https://hackmd.io/@haind-pwn/catdoc-xls-mulrk-endcol-and-...
technical-description
https://github.com/vbwagner/catdoc/blob/38a2807d22ce1a08b...
technical-description
https://github.com/vbwagner/catdoc
product

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.