Heap Buffer Overflow in libxls via Font Index

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: MITRE

Description

A heap-buffer-overflow and use-after-free vulnerability exists in the xls_getCSS() function of libxls 1.6.3 due to insufficient validation of a file-controlled font index.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-79591

Affected Vendors & Products

Vendor	Product	Version / Range
libxls	libxls	1.6.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a heap-buffer-overflow and use-after-free issue in the xls_getCSS() function of libxls version 1.6.3. It occurs because the function does not properly validate a font index controlled by a file, leading to memory corruption.

Impact Analysis

An attacker could exploit this to execute arbitrary code, crash applications using libxls, or gain unauthorized access to system memory. This may lead to data leaks, system instability, or further compromise of affected systems.

Mitigation Strategies

Update libxls to a patched version beyond 1.6.3 to address the heap-buffer-overflow and use-after-free issues in xls_getCSS().

Hi! I’m here to help you understand CVE-2026-79591. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70