CVE-2026-110600
CVE-2026-110600 · xlsxio through 0.2.37 NULL Pointer Dereference via Worksheet Relationship Without Id
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in main_sheet_get_sheetfile_expat_callback_element_start() in lib/xlsxio_read.c that allows attackers to crash applications via crafted files. Attackers can supply a .xlsx file whose workbook.xml.rels contains a worksheet Relationship lacking an Id attribute, crashing the process when xlsxioread_sheet_open() is called.
CVSS 6.8 · Media · EPSS 0,2%
- Publicación
- Actualización
Productos y versiones afectados
xlsxio
- Versiones
- ≥ 0, ≤ 0.2.37: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://github.com/brechtsanders/xlsxio/issues/151
- https://github.com/brechtsanders/xlsxio/blob/0.2.37/lib/xlsxio_read.c#L851-L866
- https://hackmd.io/@haind-pwn/xlsxio-relationship-missing-id-null-deref
- https://www.vulncheck.com/advisories/xlsxio-through-0.2.37-null-pointer-dereference-via-worksheet-relationship-without-id
- https://nvd.nist.gov/vuln/detail/CVE-2026-110600