CVE-2026-79592

CVE-2026-79592 is an out-of-bounds read (CWE-125) in the xls_dumpSummary() function of libxls 1.6.3, a C library used to parse legacy Microsoft Excel (.xls) files. The flaw occurs because OLE summary-stream offsets that are controlled by the file being parsed are not sufficiently validated, so a crafted .xls document can make the parser read beyond the intended buffer. An attacker who can get a vulnerable application to process a malicious .xls file gains read access to out-of-bounds memory, which may leak sensitive data such as adjacent process memory contents; the CVSS 3.1 score of 7.5 (C:H/I:N/A:N) reflects confidentiality-only impact with no privileges required. Any product, utility, or service that embeds libxls 1.6.3 and processes untrusted xls files is affected. There is no public proof-of-concept, the issue is not in CISA KEV, and no exploitation has been reported.

What to do: Inventory systems and applications that embed libxls 1.6.3 (including tools such as xls2csv and any bundled copies) and restrict processing of untrusted .xls files until a patched release is available. Verify downstream dependencies for libxls usage, and watch for an upstream fix and updated distribution packages; no public exploit exists, so prioritization can remain routine.