CVE-2026-111127

MEDIUM 6.1

catdoc through 0.95 Out-of-Bounds Read via xls2csv copy_unicode_string

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

catdoc through 0.95 contains an out-of-bounds read vulnerability in copy_unicode_string() in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count. Attackers can supply a crafted .xls file declaring 0xFFFF two-byte characters in LABEL, STRING, or SST records to disclose adjacent memory through xls2csv output or crash the process.

CWE	CWE-125
Vendor	catdoc
Product	catdoc
Published	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for catdoc catdoc

Be the first to know when new medium vulnerabilities affecting catdoc catdoc are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Affected Versions

catdoc / catdoc

0 ≤ 0.95

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@haind-pwn/catdoc-xls-mulrk-endcol-and-string-count-oob-read github.com: https://github.com/vbwagner/catdoc/blob/38a2807d22ce1a08bc39b94e9072a9f8f52cd86f/src/xlsparse.c#L421-L520 github.com: https://github.com/vbwagner/catdoc vulncheck.com: https://www.vulncheck.com/advisories/catdoc-through-0.95-out-of-bounds-read-via-xls2csv-copy-unicode-string

Credits

HaiND from the Post and Telecommunication Institute of Technology