Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-48jr-3rh3-95w6

Опубликовано: 03 июн. 2026
Источник: github
Github: Не прошло ревью
CVSS3: 5.3

Описание

A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reachable via xls_parseWorkBook() and is triggered by uninitialized heap memory originating from the OLE layer (ole2_read). The flaw is detectable with MemorySanitizer (MSAN) and can lead to undefined behavior, incorrect parsing logic, or potential information disclosure.

A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reachable via xls_parseWorkBook() and is triggered by uninitialized heap memory originating from the OLE layer (ole2_read). The flaw is detectable with MemorySanitizer (MSAN) and can lead to undefined behavior, incorrect parsing logic, or potential information disclosure.

EPSS

Процентиль: 12%
0.00214
Низкий

5.3 Medium

CVSS3

Дефекты

CWE-908

Связанные уязвимости

CVSS3: 5.3
ubuntu
3 месяца назад

A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reachable via xls_parseWorkBook() and is triggered by uninitialized heap memory originating from the OLE layer (ole2_read). The flaw is detectable with MemorySanitizer (MSAN) and can lead to undefined behavior, incorrect parsing logic, or potential information disclosure.

CVSS3: 5.3
nvd
3 месяца назад

A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reachable via xls_parseWorkBook() and is triggered by uninitialized heap memory originating from the OLE layer (ole2_read). The flaw is detectable with MemorySanitizer (MSAN) and can lead to undefined behavior, incorrect parsing logic, or potential information disclosure.

CVSS3: 5.3
debian
3 месяца назад

A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 whe ...

EPSS

Процентиль: 12%
0.00214
Низкий

5.3 Medium

CVSS3

Дефекты

CWE-908