Out-of-Bounds Read in catdoc XLS Parsing

Executive Summary

CVE-2026-111126 is an out-of-bounds read vulnerability in catdoc through version 0.95. It occurs in the MULRK record handler of the process_item() function in src/xlsparse.c. Attackers can exploit this by providing a crafted .xls file or BIFF stream with a large end column value. This causes the program to read past a fixed 18,000-byte buffer, potentially exposing adjacent process memory as CSV output or crashing the application.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes or unusual output when processing Excel files with catdoc's xls2csv tool. Test with a crafted .xls file containing extreme column values or string lengths to observe out-of-bounds reads or memory exposure.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to read sensitive memory contents from the process running catdoc. If exploited, it could leak confidential data, such as passwords or encryption keys, present in the application's memory. Additionally, it may cause the application to crash, leading to denial-of-service conditions.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update catdoc to the latest patched version. Avoid processing untrusted Excel files with xls2csv until patched. Implement input validation for files processed by catdoc to limit column and string lengths.

Useful 0 Not Useful 0