CVE-2026-110600

Deferred Deferred - Pending Action

NULL Pointer Dereference in xlsxio via Malformed XLSX File

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in main_sheet_get_sheetfile_expat_callback_element_start() in lib/xlsxio_read.c that allows attackers to crash applications via crafted files. Attackers can supply a .xlsx file whose workbook.xml.rels contains a worksheet Relationship lacking an Id attribute, crashing the process when xlsxioread_sheet_open() is called.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110600

EUVD

EUVD-2026-101228

Affected Vendors & Products

Vendor	Product	Version / Range
brechtsanders	xlsxio	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

CVE-2026-110600 is a NULL pointer dereference vulnerability in the xlsxio library (version 0.2.37) that occurs when processing malformed Excel files. The issue arises when a worksheet relationship in the file workbook.xml.rels lacks an Id attribute. This causes the library to crash when attempting to open a sheet via xlsxioread_sheet_open().

Detection Guidance

To detect this vulnerability, monitor for crashes in applications using xlsxio when processing .xlsx files. Check for segmentation faults or AddressSanitizer errors during file parsing. Examine logs for processes handling Excel files with malformed workbook.xml.rels files lacking Id attributes.

Impact Analysis

This vulnerability can cause applications using the xlsxio library to crash when processing a specially crafted .xlsx file. This leads to denial of service, as the application terminates unexpectedly. If exploited, it could disrupt services relying on the library to read Excel files.

Compliance Impact

This vulnerability primarily causes application crashes (denial of service) when processing malformed Excel files. It does not directly expose or leak data, so it may not directly violate GDPR or HIPAA data confidentiality requirements. However, repeated crashes could disrupt systems handling sensitive data, potentially leading to compliance issues if critical operations are interrupted.

Mitigation Strategies

Immediately update xlsxio to a patched version if available. If not, disable parsing of .xlsx files in applications using xlsxio until patched. Implement input validation for .xlsx files, rejecting files with malformed workbook.xml.rels. Monitor for crashes in processes using xlsxio.

Hi! I’m here to help you understand CVE-2026-110600. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70