OpenMcdf up to 3.1.3 Directory Tree DirectoryTree.cs TryGetDirectoryEntry infinite loop

Summaryinfo

A vulnerability was found in OpenMcdf up to 3.1.3. It has been classified as problematic. The affected element is the function TryGetDirectoryEntry of the file OpenMcdf/DirectoryTree.cs of the component Directory Tree. The manipulation leads to infinite loop. This vulnerability is traded as CVE-2026-45785. An attack has to be approached locally. There is no exploit available.

Detailsinfo

A vulnerability was found in OpenMcdf up to 3.1.3. It has been rated as problematic. This issue affects the function TryGetDirectoryEntry of the file OpenMcdf/DirectoryTree.cs of the component Directory Tree. The manipulation with an unknown input leads to a infinite loop vulnerability. Using CWE to declare the problem leads to CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. Impacted is availability. The summary by CVE is:

OpenMcdf is a fully .NET / C# library to manipulate Compound File Binary File Format files, also known as Structured Storage. In 3.1.3 and earlier, the BST name-lookup loop in DirectoryTree.TryGetDirectoryEntry (OpenMcdf/DirectoryTree.cs:35-46) walks directory entries by repeatedly calling directories.TryGetSibling(child, siblingType, validateColor). A crafted CFB file with cyclic Left/Right sibling links among directory entries, constructed so the per-step BST-order check in TryGetSibling (DirectoryEntries.cs:84-85) is satisfied at every step, drives this while (child is not null) loop forever. There is no cycle detection in TryGetDirectoryEntry, and the bug is reachable from RootStorage.OpenStorage(name), TryOpenStorage(name), OpenStream(name), and TryOpenStream(name), causing an unrecoverable denial of service. This issue is fixed in version 3.1.4.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-45785 since 05/13/2026. The exploitation is known to be easy. Attacking locally is a requirement. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 3.1.4 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• OpenMcdf

Version

• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3

Website

• Product: https://github.com/openmcdf/openmcdf/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion