catdoc CVE-2026-111127

Exploitation requires that a victim user or an automated pipeline process an attacker-supplied, specially crafted .xls file through catdoc's xls2csv tool; the file must declare 0xFFFF two-byte characters in a LABEL, STRING, or SST record so that copy_unicode_string() reads beyond the buffer. Limiting factors: the attack is local (AV:L) and gated by user interaction (UI:P) - the victim must actively invoke xls2csv on the malicious file - and only catdoc versions through 0.95 are affected. No non-default configuration is required beyond using the xls2csv functionality. Risk rises materially in server-side contexts that auto-process untrusted documents, where the required 'interaction' is performed by the service rather than a human.

This is a genuine but moderate-severity issue, best characterized as a high-impact-in-narrow-contexts flaw rather than a mass-exploitation priority. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H) scores 6.9 (Medium): the attack is local and requires passive user interaction (a victim must run xls2csv on an attacker-supplied .xls file), which sharply limits remote, automated exploitation. Impact is split - low confidentiality (VC:L, adjacent heap/stack bytes leaked into CSV output) and high availability (VA:H, process crash) - with no integrity impact and no code execution, consistent with CWE-125 (out-of-bounds read, not a write). No CISA KEV listing and no explicit POC/exploit-code flag were provided in the input, so exploitation is theoretical at analysis time, though a detailed public technical write-up (hackmd) and the exact vulnerable source lines are referenced, lowering the bar for a working PoC. There are no strongly conflicting signals: the Medium CVSS, absence of KEV, and local/UI-gated vector all point to limited real-world urgency. One caveat for defenders: the 'local' vector understates risk in server-side document-processing pipelines (indexers, antivirus pre-processors, mail gateways) that invoke catdoc automatically on untrusted files - in those deployments a 'crafted file' effectively becomes remotely deliverable even though CVSS rates it AV:L.

An attacker crafts a malicious .xls file whose LABEL, STRING, or SST record declares 0xFFFF two-byte characters, then delivers it (e.g., via email attachment or upload) to a victim or a document-processing system. When the file is converted using xls2csv, copy_unicode_string() reads past the allocated buffer, leaking adjacent memory contents into the CSV output or crashing the process. No public exploit code was identified in the provided data, though a detailed technical write-up and the exact vulnerable source lines are publicly referenced.