CVE-2026-79591

Deferred Deferred - Pending Action

Heap Buffer Overflow in libxls via Font Index

Publication date: 2026-09-10

Last updated on: 2026-09-22

Assigner: MITRE

Description

A heap-buffer-overflow and use-after-free vulnerability exists in the xls_getCSS() function of libxls 1.6.3 due to insufficient validation of a file-controlled font index.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-22

Generated

2026-10-01

AI Q&A

2026-09-11

EPSS Evaluated

2026-09-29

NVD

CVE-2026-79591

Affected Vendors & Products

Vendor	Product	Version / Range
libxls	libxls	1.6.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability is a heap-buffer-overflow and use-after-free issue in the xls_getCSS() function of libxls version 1.6.3. It occurs because the function does not properly validate a font index controlled by a file, leading to memory corruption.

Impact Analysis

An attacker could exploit this to execute arbitrary code, crash applications using libxls, or gain unauthorized access to system memory. This may lead to data leaks, system instability, or further compromise of affected systems.

Compliance Impact

The vulnerability involves a heap-buffer-overflow and use-after-free in libxls 1.6.3, which could lead to arbitrary code execution or crashes when processing maliciously crafted files. This may impact compliance with GDPR or HIPAA if such files are processed in systems handling sensitive personal or health data, potentially causing unauthorized access or data breaches.

Mitigation Strategies

Update libxls to a patched version beyond 1.6.3 to address the heap-buffer-overflow and use-after-free issues in xls_getCSS().

Hi! I’m here to help you understand CVE-2026-79591. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70