PT-2026-23859 · Xlnt · Xlnt

Oneafter · Published 2026-03-07 · Updated 2026-03-10 · CVE-2026-3663

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions xlnt versions up to 1.6.1

Description A flaw exists within the xlnt library, specifically in the XLSX File Parser component. This issue resides in the xlnt::detail::compound document istreambuf::xsgetn function within the source/detail/cryptography/compound document.cpp file. A manipulation of the file can lead to an out-of-bounds read, and the exploit has been publicly disclosed. The issue is only exploitable with local access.

Recommendations Apply patch 147 to resolve this issue.

Exploit

Fix

Buffer Overflow

Out of bounds Read

Weakness Enumeration

CWE-119

CWE-125

Related Identifiers

CVE-2026-3663

Affected Products

Xlnt

References · 15

• 🔥 https://github.com/oneafter/0128/blob/main/xl3/repro · Exploit
• https://github.com/xlnt-community/xlnt/pull/147 · Patch
• https://github.com/xlnt-community/xlnt/issues/139 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3663 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3663 · Vendor Advisory
• https://t.me/cveNotify/154982 · Telegram Post
• https://twitter.com/CVEnew/status/2030339317584015812 · Twitter Post
• https://twitter.com/cyberbivash/status/2030317520863777275 · Twitter Post
• https://vuldb.com/?id.349552 · Note
• https://github.com/xlnt-community/xlnt · Note
• https://twitter.com/VulmonFeeds/status/2030306550833623399 · Twitter Post
• https://vuldb.com/?ctiid.349552 · Note
• https://t.me/cveNotify/154596 · Telegram Post
• https://vuldb.com/?submit.764644 · Note
• https://t.me/CVEtracker/46724 · Telegram Post