CVE-2023-46345
LowSummary
Catdoc v0.95 contains a NULL pointer dereference in the xls2csv component at src/xlsparse.c. This can lead to an application crash.
Risk Assessment
A crafted XLS file can crash xls2csv, causing denial of service. This may disrupt spreadsheet conversion.
Recommendation
Upgrade catdoc to a version containing a fix or avoid processing untrusted XLS files. Implement input file validation.
Other vulnerabilities in Catdoc
See all- CVE-2017-11110High
The ole_init function in ole.c in catdoc 0.95 allows remote attackers to cause a denial of service (heap-based buffer underflow and application crash) or possibly have unspecified other impact via a crafted file.
- CVE-2026-111127Medium
catdoc through 0.95 contains an out-of-bounds read vulnerability in copy_unicode_string() in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count. Attackers can supply a crafted .xls file declaring 0xFFFF two-byte characters in LABEL, STRING, or SST records to disclose adjacent memory through xls2csv output or crash the process.
- CVE-2026-111126Medium
catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of process_item() in src/xlsparse.c that allows attackers to read past the static rec buffer via a crafted end column. Attackers can supply a crafted .xls workbook or BIFF stream with a large endcol to xls2csv to disclose adjacent process memory as CSV cells or crash the process.
Original NVD description (English source)
Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/xlsparse.c.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS