CVE-2026-79591

libxls 1.6.3, an open-source C library for parsing legacy Excel (.xls) files, contains a heap-buffer-overflow and use-after-free in the xls_getCSS() function because a font index read from the workbook file is not adequately validated. A remote attacker can craft a malicious .xls file that, when opened or parsed by any application embedding the vulnerable library, causes out-of-bounds reads/writes or access to freed memory. Successful exploitation can crash the parsing application or potentially execute arbitrary code in its security context, with high impact on confidentiality, integrity, and availability (CVSS 7.8). Because exploitation requires user interaction, the victim must be induced to open the malicious file, e.g., via an email attachment or an uploaded file processed server-side. No public proof-of-concept is known, the flaw is not in the CISA KEV catalog, and there is no evidence of exploitation in the wild.

What to do: Upgrade libxls to the latest upstream release (anything newer than 1.6.3, or apply the upstream patch) and rebuild/redeploy any applications that statically or dynamically bundle the library. Audit your software supply chain to identify products that embed libxls 1.6.3 and confirm the fix with them. In the interim, treat untrusted .xls files as hostile: scan uploads, sandbox file parsing, and avoid opening spreadsheets from unknown sources.