Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111126— catdoc through 0.95 Out-of-Bounds Read in xls2csv MULRK Record Handler

Quick assessment

Affected
catdoc catdoc
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

catdoc 在 0.95 及之前版本中存在一个堆外读漏洞，该漏洞位于 src/xlsparse.c 文件中 process_item() 函数的 MULRK 记录处理程序。攻击者可以通过构造的末列（end column）值，读取静态 rec 缓冲区边界之外的内存内容。攻击者可以向 xls2csv 工具提供一个精心构造的 .xls 工作簿或 BIFF 流，其中包含一个过大的 endcol 字段，从而将相邻进程内存内容作为 CSV 单元格输出，或导致程序崩溃。

CVSS 6.1 · Medium EPSS 0.20% · P9

Possible ATT&CK Techniques 1 AI

T1213 · Data from Information Repositories

Affected Version Matrix 1

VendorProduct Version RangeStatus
catdoc catdoc ≤ 0.95 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-111126

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
catdoc through 0.95 Out-of-Bounds Read in xls2csv MULRK Record Handler
Source: CVE Program / CVE List V5
Vulnerability Description
catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of process_item() in src/xlsparse.c that allows attackers to read past the static rec buffer via a crafted end column. Attackers can supply a crafted .xls workbook or BIFF stream with a large endcol to xls2csv to disclose adjacent process memory as CSV cells or crash the process.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
catdoc catdoc 0 ~ 0.95 -

II. Public POCs for CVE-2026-111126

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111126

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-111126 (1)

Vendor Advisories for CVE-2026-111126 (1)

Security Blog Posts for CVE-2026-111126 (1)

Other References for CVE-2026-111126 (1)

IV. Related Vulnerabilities

Same product: catdoc
Same vendor: catdoc
Same weakness: CWE-125

V. Comments for CVE-2026-111126

No comments yet

Leave a comment