Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before being consumed by ole2_validate_sector_chain(), which may result in application crashes or potential information disclosure when processing a crafted XLS file
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-26824 Use of Uninitialized Memory in libxls OLE Container Parser Through 1.6.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26824
Post summary
The text discloses an uninitialized memory bug in libxls OLE Container Parser up to version 1.6.3, but provides no evidence of exploitation, patches, or PoC.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | libxls_project | libxls | - | - | - |