CVE-2026-110600

14th percentile - higher than 14% of all known CVEs

xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in main_sheet_get_sheetfile_expat_callback_element_start() in lib/xlsxio_read.c that allows attackers to crash applications via crafted files. Attackers can supply a .xlsx file whose workbook.xml.rels contains a worksheet Relationship lacking an Id attribute, crashing the process when xlsxioread_sheet_open() is called.

An attacker can remotely crash an application processing .xlsx files, causing denial of service (DoS) and potential operational disruptions.

Upgrade xlsxio beyond 0.2.37 if available, or implement validation of .xlsx files for the presence of the Id attribute in worksheet relationships before processing. Consider restricting processing of untrusted files.