CVE-2026-111127 — catdoc through 0.95 Out-of-Bounds Read via xls2csv copy_unicode_string
catdoc through 0.95 contains an out-of-bounds read vulnerability in copy_unicode_string() in src/xlsparse.c that allows attackers to read past buffers via an unchecked string ch…
Published: 2026-10-15 · CVSS: 6.9 · CVSS 4.0
catdoc through 0.95 contains an out-of-bounds read vulnerability in copy_unicode_string() in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count. Attackers can supply a crafted .xls file declaring 0xFFFF two-byte characters in LABEL, STRING, or SST records to disclose adjacent memory through xls2csv output or crash the process.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7