CVE-2026-111126 in Catdoc
Summary
by MITRE • 10/15/2026
catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of process_item() in src/xlsparse.c that allows attackers to read past the static rec buffer via a crafted end column. Attackers can supply a crafted .xls workbook or BIFF stream with a large endcol to xls2csv to disclose adjacent process memory as CSV cells or crash the process.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in catdoc versions through 0.95 represents a critical out-of-bounds read flaw located within the MULRK record handler of the process_item function found in src/xlsparse.c. This component is responsible for parsing Microsoft Excel Binary Interchange File Format (BIFF) streams, specifically handling records that contain multiple rich text or numeric values. The root cause lies in insufficient validation of input parameters during the processing of these binary structures. When a crafted .xls workbook or BIFF stream is provided to tools like xls2csv, an attacker can manipulate specific fields within the MULRK record structure. By supplying an excessively large end column value, the parser fails to correctly bound-check memory access operations against the allocated static rec buffer. This logical error allows the application to read data from memory locations that lie beyond the intended boundaries of the buffer.
From a technical perspective, this flaw is classified under CWE-125, which denotes Out-of-bounds Read vulnerabilities. The exploitation mechanism relies on the parser's inability to verify whether the calculated memory offset derived from the crafted end column index remains within the limits of the statically allocated array. In C-based applications like catdoc, such boundary check failures are common when developers assume input data integrity or fail to account for maliciously altered binary structures. When xls2csv processes a file with this specific malformed record, it attempts to access memory addresses that were not intended for use by the current parsing context. This results in the disclosure of adjacent process memory contents, which may include sensitive information such as stack canaries, heap metadata, or other application data residing nearby in virtual memory space.
The operational impact of this vulnerability is significant due to its potential for both information leakage and denial of service. On one hand, an attacker who can trick a user into opening a maliciously crafted .xls file using catdoc or xls2csv could potentially exfiltrate sensitive data from the victim's system by analyzing the output CSV cells that contain leaked memory bytes. This side-channel effect compromises confidentiality requirements for systems processing untrusted spreadsheet documents. On the other hand, if the out-of-bounds read triggers a segmentation fault due to accessing unmapped memory pages or protected regions, it results in an application crash. This constitutes a denial of service condition, disrupting productivity and potentially causing instability in environments where automated document conversion pipelines are employed without adequate sandboxing or monitoring.
In terms of threat modeling, this vulnerability aligns with ATT&CK technique T1059, Command and Scripting Interpreter, specifically regarding the use of scripts to execute malicious actions if combined with further exploitation steps, though primarily it falls under data exfiltration vectors like T1005, Data from Local System. The attack vector is typically remote or local depending on whether the file is delivered via email attachment, shared drive, or direct download, making social engineering a likely precursor to successful exploitation. Defense in depth strategies are essential here since client-side applications often process untrusted data with elevated privileges relative to web browsers.
Mitigation efforts should prioritize immediate patching of catdoc and xls2csv to versions that include proper bounds checking within the MULRK record handler. Developers must ensure that all array indices derived from external binary inputs are validated against buffer sizes before access occurs. For organizations unable to immediately update, implementing input validation at the ingestion layer or using sandboxed environments for document conversion can reduce risk. Additionally, enabling memory protection features such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) on target systems can mitigate the impact of successful exploitation by making it harder to predict memory layouts and execute code based on leaked information. Regular security audits focusing on C/C++ buffer management practices are recommended to prevent similar out-of-bounds errors in legacy software components.