EUVD-2026-101228
GHSA-6j5v-fg26-wg57
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft .xlsx with Relationship missing Id
-
ExploitDeliver file to xlsxio-based app
-
ExecutionCall xlsxioread_sheet_open parses rels
-
ImpactNULL pointer dereference crashes process
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target application to parse an attacker-supplied .xlsx file using xlsxio and to reach the xlsxioread_sheet_open() code path; the malicious file must contain a workbook.xml.rels with a worksheet Relationship element that omits the required Id attribute. Limiting factors: the vector is local with passive user interaction (the victim or a service must open/process the file), the only impact is a crash (no code execution, no data exposure), and it affects xlsxio versions through 0.2.37. Realistic exposure is confined to software that accepts untrusted spreadsheets and links this specific library. |
| Impact | This is a moderate, availability-only issue (CVSS 4.0 base 6.8, VA:H with VC:N/VI:N) whose real-world risk is low-to-moderate. The CVSS 4.0 vector is local with passive user interaction (AV:L/AC:L/AT:N/PR:N/UI:P), meaning the attacker does not authenticate but must get a victim application to parse a malicious .xlsx file - there is no network-facing, unauthenticated path and no confidentiality or integrity impact, only a process crash (NULL pointer dereference, CWE-476). EPSS is not provided in the input and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation; however, a detailed public technical write-up (hackmd.io) and a VulnCheck advisory describe the exact crafting technique, so the barrier to reproducing a crash is very low. Signals are internally consistent: a low-complexity DoS in a parsing library with public exploit detail but no observed in-the-wild use. The practical priority depends almost entirely on where xlsxio is embedded - it is elevated for any service that ingests untrusted spreadsheets, and negligible for offline/local-only use. |
| Exploit ScenarioDerived | An attacker crafts a .xlsx file whose workbook.xml.rels declares a worksheet Relationship element with no Id attribute, then delivers it to a service or user whose application uses xlsxio to read spreadsheets. When the application calls xlsxioread_sheet_open(), the missing Id causes a NULL pointer dereference in main_sheet_get_sheetfile_expat_callback_element_start() and the process crashes. A public technical write-up (hackmd.io) and a VulnCheck advisory document the technique, making reproduction trivial, though impact is limited to denial of service. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
NULL pointer dereference in the xlsxio C library (through version 0.2.37) lets a crafted .xlsx file crash any application that parses it with xlsxioread_sheet_open(), causing a denial of service. The trigger is a workbook.xml.rels file containing a worksheet Relationship element that omits the required Id attribute, which makes main_sheet_get_sheetfile_expat_callback_element_start() in lib/xlsxio_read.c dereference a NULL attribute pointer. Exploitation is rated moderate at CVSS 4.0 base 6.8 (availability-only, no confidentiality or integrity impact) with unauthenticated local access and passive user interaction; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV, so real-world risk is low-to-moderate and confined to software that opens untrusted spreadsheets with this library.
RemediationAI
No vendor-released patch was identified at time of analysis: up to and including 0.2.37 the affected code path is unchanged, and the tracking issue (https://github.com/brechtsanders/xlsxio/issues/151) is the place to watch for an upstream fix - if you build from source, apply or backport a NULL check on the Id/Target attribute pointers in main_sheet_get_sheetfile_expat_callback_element_start() in lib/xlsxio_read.c (see https://github.com/brechtsanders/xlsxio/blob/0.2.37/lib/xlsxio_read.c#L851-L866) and rebuild; such an upstream commit or PR would be a source-level fix rather than a tagged release, so a patched version should not be assumed until it is published. Until then, the most effective compensating control is input validation before parsing: pre-scan or sanitize any untrusted .xlsx by unzipping it and rejecting or repairing workbook.xml.rels entries where a Relationship element lacks an Id attribute (the affected parser aborts only on that malformed shape), which is cheap but requires a custom pre-parser that itself must be robust to zip bombs and malformed archives. Isolate the parsing step - run the conversion in a short-lived worker/subprocess with memory and CPU limits and automatic restart, or in a container/sandbox with no privileges - so a crash degrades to a failed job instead of taking down the service; the trade-off is added operational complexity and latency. Where xlsxio is only used for reading, consider substituting an actively maintained OOXML reader, or restrict processing to files from trusted sources and quarantine/convert inbound spreadsheets on an isolated host; disabling the feature that opens untrusted workbooks entirely removes exposure but breaks functionality. Note that because the flaw is availability-only, patching or isolating is sufficient - there is no credential-rotation or data-exposure follow-up required after a crash.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
xlsxio is a lightweight C library (by Brechtsanders) for reading and writing .xlsx files; it relies on the expat streaming XML parser for workbook parts and minizip/zlib for the OOXML container. During workbook load, workbook.xml.rels is parsed with expat SAX-style callbacks, and main_sheet_get_sheetfile_expat_callback_element_start() (lib/xlsxio_read.c, roughly lines 851-866 at tag 0.2.37) handles <Relationship> start tags by extracting the Id attribute and mapping it to a sheet file path. Because the function does not validate that the Id (and related attributes such as Target) are present before dereferencing the returned pointer, an attacker-controlled rels file with a <Relationship .../> element that lacks Id causes a straight NULL pointer dereference, classified as CWE-476. The vulnerable CPE cpe:2.3:a:brechtsanders:xlsxio:*:*:*:*:*:*:*:* matches all released versions up to and including 0.2.37; the parse path is reached whenever an application calls xlsxioread_sheet_open() on an attacker-supplied workbook. Impact is purely a process abort/crash - no memory corruption primitive, code execution, or data disclosure is described in the evidence.
Know when Xlsxio gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Parsing an attacker-supplied local file requires victim action (UI:R) and no privileges (PR:N); crash-only impact gives A:H with C:N/I:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in main_sheet_get_sheetfile_expat_callback_element_start() in lib/xlsxio_read.c that allows attackers to crash applications via crafted files. Attackers can supply a .xlsx file whose workbook.xml.rels contains a worksheet Relationship lacking an Id attribute, crashing the process when xlsxioread_sheet_open() is called.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB