CVE-2026-110600 in xlsxio
Summary
by MITRE • 10/14/2026
xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in main_sheet_get_sheetfile_expat_callback_element_start() in lib/xlsxio_read.c that allows attackers to crash applications via crafted files. Attackers can supply a .xlsx file whose workbook.xml.rels contains a worksheet Relationship lacking an Id attribute, crashing the process when xlsxioread_sheet_open() is called.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in xlsxio versions up to 0.2.37 represents a critical memory safety flaw rooted in improper input validation within the library's XML parsing logic. Specifically, the defect resides in the main_sheet_get_sheetfile_expat_callback_element_start function located in lib/xlsxio_read.c. This component is responsible for processing relationships defined in workbook.xml.rels files when opening Excel workbooks. The core technical issue arises from a NULL pointer dereference that occurs during the parsing of worksheet relationship definitions. When an attacker supplies a maliciously crafted .xlsx file, they can manipulate the internal data structures to trigger this crash condition without requiring any authentication or user interaction beyond the initial attempt to open the document.
The operational mechanism of the exploit relies on the structure of Office Open XML files, which use relational links to define connections between different parts of a workbook. In a valid .xlsx file, worksheet relationships must include an Id attribute that references a specific sheet within the workbook. However, in this vulnerability scenario, the attacker constructs a workbook.xml.rels section containing a worksheet Relationship element that deliberately omits or corrupts the required Id attribute. When xlsxioread_sheet_open is invoked to process this malformed structure, the library attempts to resolve the missing identifier by accessing a pointer that was never properly initialized due to the absent attribute. This results in the program attempting to dereference a NULL pointer, leading to an immediate segmentation fault and application termination.
From a security impact perspective, this vulnerability primarily facilitates Denial of Service (DoS) attacks against applications integrating xlsxio for spreadsheet processing. While modern systems often isolate such crashes within sandboxed environments or handle exceptions gracefully in higher-level wrappers, the underlying library behavior remains unsafe. An attacker who can force a victim application to open a specially crafted file can cause the process to crash reliably. This is particularly dangerous in server-side applications that automatically parse uploaded files for content analysis, as it allows remote attackers to disrupt service availability with minimal effort and no prior access privileges.
This flaw aligns closely with CWE-476, which describes NULL Pointer Dereference vulnerabilities where a program dereferences a pointer that it expects to be valid but is actually null. Furthermore, in the context of the MITRE ATT&CK framework, this vulnerability supports techniques associated with Resource Hijacking or Denial of Service, specifically under tactics like Impact or Execution depending on how the crash propagates within the host system. The lack of robust error handling for malformed XML structures highlights a common weakness in libraries that prioritize performance over strict input validation during early development phases.
To mitigate this risk, developers integrating xlsxio must ensure they are using version 0.2.38 or later, where the NULL pointer dereference has been addressed through improved validation of relationship attributes before processing. For applications unable to upgrade immediately, implementing a pre-processing step that validates the integrity and structure of incoming .xlsx files can provide an additional layer of defense. This includes checking for required XML attributes such as Id in worksheet relationships before passing data to the library's parsing functions. Additionally, deploying runtime application self-protection mechanisms or memory safety wrappers like AddressSanitizer during testing phases can help identify similar latent issues in custom implementations that rely on this library.