CVE-2026-41034
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via pictFmla.cbBufInCtlStm and other vectors), leading to an information leak and ASLR bypass.
Risk Assessment
Information leakage and ASLR bypass can help an attacker further exploit vulnerabilities and evade memory protections. The risk affects organizations processing untrusted XLS files in ONLYOFFICE DocumentServer.
Recommendation
Update ONLYOFFICE DocumentServer to version 9.3.0 or later. Restrict processing of untrusted XLS files and consider running conversions in an isolated environment.
Other vulnerabilities in ONLYOFFICE DocumentServer
See all- CVE-2023-30187Critical
An out-of-bounds memory access vulnerability in ONLYOFFICE DocumentServer versions 4.0.3 through 7.3.2. A remote attacker can execute arbitrary code using a crafted JavaScript file.
- CVE-2023-30186Critical
A use-after-free vulnerability in ONLYOFFICE DocumentServer versions 4.0.3 through 7.3.2 allows remote attackers to execute arbitrary code via a crafted JavaScript file.
- CVE-2026-110652Medium
ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint. Attackers can bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in the default configuration, causing the server to fetch and proxy back arbitrary private-network and cloud metadata content.
Original NVD description (English source)
ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via pictFmla.cbBufInCtlStm and other vectors), leading to an information leak and ASLR bypass.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS