PT-2026-46058 · Libxls · Libxls

Richard Howe + 1 · CVE-2026-26825 · Published 2026-06-03 · Updated 2026-07-22

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions libxls version 1.6.3

Description A use-of-uninitialized memory issue occurs when parsing malformed XLS files. The flaw is triggered by uninitialized heap memory originating from the OLE layer ole2 read and is reachable via the xls parseWorkBook() function. This can result in undefined behavior, incorrect parsing logic, or potential information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

CVE-2026-26825

Affected Products

Libxls

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26825.json · Exploit
• 🔥 https://github.com/libxls/libxls/issues/156 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2026-26825 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26825 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-26825 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-26825 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-26825 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26825 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-26825 · Vendor Advisory
• https://t.me/CVEtracker/55762 · Telegram Post
• https://t.me/cveNotify/213313 · Telegram Post