Vulnerability · Published Oct 15, 2026 · Assigned by VulnCheck
CVE-2026-111126catdoc through 0.95 Out-of-Bounds Read in xls2csv MULRK Record Handler
Medium 6.1
In plain English
A medium-severity out-of-bounds read in catdoc from catdoc. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.2%top 90.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of process_item() in src/xlsparse.c that allows attackers to read past the static rec buffer via a crafted end column. Attackers can supply a crafted .xls workbook or BIFF stream with a large endcol to xls2csv to disclose adjacent process memory as CSV cells or crash the process.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | catdoc | no fix listed | DEBIAN-CVE-2026-111126 |
| Debian:13 | catdoc | no fix listed | DEBIAN-CVE-2026-111126 |
| Debian:14 | catdoc | no fix listed | DEBIAN-CVE-2026-111126 |
| Ubuntu:26.04:LTS | catdoc | no fix listed | UBUNTU-CVE-2026-111126 |
| Ubuntu:26.10 | catdoc | no fix listed | UBUNTU-CVE-2026-111126 |
Affected products (as reported)
Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
References
- https://hackmd.io/@haind-pwn/catdoc-xls-mulrk-endcol-and-string-count-oob-read technical-description
- https://github.com/vbwagner/catdoc/blob/38a2807d22ce1a08bc39b94e9072a9f8f52cd86f/src/xlsparse.c#L314-L328 technical-description
- https://github.com/vbwagner/catdoc product
- VulnCheck Advisory: catdoc through 0.95 Out-of-Bounds Read in xls2csv MULRK Record Handler third-party-advisory