Heap-Based Buffer Overflow in xlnt Compound Document Parser

Executive Summary

CVE-2026-3463 is a heap-based buffer overflow vulnerability found in the xlnt library, specifically in the function xlnt::detail::binary_writer::append within the Compound Document Parser component.

The vulnerability occurs because the code allocates a fixed 512-byte buffer for a sector (corresponding to the standard OLE sector size) but attempts to write an additional 64 bytes immediately after this buffer without proper boundary checks. This causes heap corruption.

This overflow happens during the parsing of the Master Sector Allocation Table (MSAT) in malformed Compound Document files, commonly used for encrypted XLSX files.

The issue arises from improper offset calculations or insufficient bounds checking when appending data to the sector buffer, leading to a write beyond the allocated memory.

The vulnerability can be triggered locally by processing specially crafted malformed files, and a proof-of-concept exploit is publicly available.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is a heap-based buffer overflow occurring locally during the parsing of malformed Compound Document files in the xlnt library. Detection involves triggering the vulnerable code path, typically by loading a specially crafted XLSX file that causes the overflow.

Detection was performed using AddressSanitizer (ASAN) on a Linux x86_64 system compiled with Clang in Release mode with ASAN enabled. ASAN reported a write of 64 bytes immediately after a 512-byte allocated buffer, confirming the heap-buffer-overflow.

A minimal reproducer harness is available which loads a file using the function `xlnt::workbook::load` and iterates over cells, triggering the overflow when processing a crafted malformed file.

Suggested detection approach includes running the vulnerable xlnt library with ASAN enabled and loading suspicious or malformed XLSX files to observe heap-buffer-overflow errors.

No specific network commands are applicable since the attack requires local execution and is triggered by file parsing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability impacts the availability of the affected system by causing heap corruption, which can lead to application crashes or denial of service.

Since the overflow is heap-based, it may also be leveraged for further exploitation, although the CVE details indicate it does not directly affect confidentiality or integrity.

Exploitation requires local access, meaning an attacker must have local privileges to trigger the overflow.

The attack is considered easy to perform, and an exploit is publicly available, increasing the risk to users running vulnerable versions (up to 1.6.1) of the xlnt library.

Applying the provided patch (patch 147) is recommended to mitigate this vulnerability.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to apply the patch released by the xlnt-community, identified as patch 147, which addresses the heap-buffer-overflow by implementing proper bounds checking and memory safety improvements.

Users of xlnt versions up to 1.6.1 should upgrade to a patched version that includes these fixes.

Avoid processing untrusted or malformed XLSX files with vulnerable versions of the xlnt library until the patch is applied.

Review and apply the improvements from the pull request #147 on the official xlnt GitHub repository, which includes enhanced memory safety, exception handling, and compliance with the MS-CFB specification.

Useful 0 Not Useful 0