catdoc CVE-2026-111126

Exploitation requires that xls2csv (catdoc <= 0.95) be run against an attacker-supplied .xls workbook or raw BIFF stream that contains a MULRK record whose end-column (endcol) value is larger than the static rec buffer can accommodate. The concrete prerequisite is therefore: the target must parse an untrusted spreadsheet with the vulnerable tool. Limiting factors: the attack vector is local (AV:L) - the malicious file must reach and be processed on the host - and user/service interaction is required (UI:P), i.e. someone or some automated job must actually invoke xls2csv on the file; there is no authentication required (PR:N) and no special non-default configuration is needed beyond having catdoc installed and used for .xls conversion. Impact is bounded to leaking limited adjacent memory into CSV output or crashing the single conversion process.

This is a moderate, not top-tier, priority. The input CVSS 4.0 vector (AV:L/AC:L/PR:N/UI:P) and the description agree that exploitation is LOCAL and requires the victim to run xls2csv against an attacker-controlled file (passive user interaction) - there is no network-facing attack surface, so this is not a remotely wormable flaw. Technical impact is split: limited confidentiality via an out-of-bounds read that leaks adjacent process memory into CSV output (VC:L), and high availability impact via process crash (VA:H); there is no integrity impact. No EPSS score, no CISA KEV listing, and no explicit POC flag were provided in the input, so exploitation probability cannot be quantified from the data - however, a detailed public technical writeup (hackmd) and the exact vulnerable source lines are referenced, which materially lowers the barrier to developing an exploit even though no weaponized exploit is confirmed. The realistic risk concentrates in automated server-side pipelines (mail filters, AV/DLP text extractors, indexing systems) that invoke catdoc/xls2csv on untrusted .xls files; for interactive desktop use the UI:P requirement and local vector keep risk low. Net: credible but bounded - treat as a patch-when-reasonable issue, prioritized higher only where catdoc auto-processes untrusted documents.

An attacker crafts an .xls workbook (or raw BIFF stream) containing a MULRK record with an oversized end column and delivers it to a system that converts spreadsheets with xls2csv - for example an email or document-ingestion pipeline. When the victim or automated service runs xls2csv on the file, the MULRK handler reads past the static rec buffer, emitting adjacent process memory as extra CSV cells (information disclosure) or crashing the process (denial of service). No confirmed public exploit exists, but a detailed technical writeup referencing the exact vulnerable code is publicly available.