CVE-2023-34795

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

xlsxio v0.1.2 to v0.2.34 was discovered to contain a free of uninitialized pointer in the xlsxioread_sheetlist_close() function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted XLSX file.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/brechtsanders/xlsxio/commit/d653f1604b54532f11b45dca1fa164b4a1f15e2dPatch
https://github.com/brechtsanders/xlsxio/issues/121Exploit, Issue Tracking, Third Party Advisory
https://github.com/xf1les/cve-advisories/blob/main/2023/CVE-2023-34795.mdExploit, Third Party Advisory
https://github.com/brechtsanders/xlsxio/commit/d653f1604b54532f11b45dca1fa164b4a1f15e2dPatch
https://github.com/brechtsanders/xlsxio/issues/121Exploit, Issue Tracking, Third Party Advisory
https://github.com/xf1les/cve-advisories/blob/main/2023/CVE-2023-34795.mdExploit, Third Party Advisory

Timeline

Published: Jun 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-347966.1Cross site scripting (XSS) vulnerabiliy in dmarcts-report-viewer dashboard versions 1.1 and thru commit 8a1d882b4c481a05e296e9b38a7961e91214 CVE-2023-347975.4Broken access control in the Registration page (/Registration.aspx) of Termenos CWX v8.5.6 allows attackers to access sensitive information.CVE-2023-347989.8An arbitrary file upload vulnerability in eoffice before v9.5 allows attackers to execute arbitrary code via uploading a crafted file.CVE-2023-348009.8D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at genacgi_main.CVE-2023-34816.1Critters versions 0.0.17-0.0.19 have an issue when parsing the HTML, which leads to a potential cross-site scripting (XSS) bug. We recommend CVE-2023-34826.5When Firefox is configured to block storage of all cookies, it was still possible to store data in localstorage by using an iframe with a so CVE-2023-348235.5fdkaac before 1.0.5 was discovered to contain a stack overflow in read_callback function in src/main.c.CVE-2023-348245.5fdkaac before 1.0.5 was discovered to contain a heap buffer overflow in caf_info function in caf_reader.c.CVE-2023-348296.5Incorrect access control in TP-Link Tapo before v3.1.315 allows attackers to access user credentials in plaintext.CVE-2023-348305.4i-doit Open v24 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the timeout parameter on the login page.CVE-2023-348315.4The "Submission Web Form" of Turnitin LTI tool/plugin version 1.3 is affected by HTML Injection attacks. The security issue affects the subm CVE-2023-348329.8TP-Link Archer AX10(EU)_V1.2_230220 was discovered to contain a buffer overflow via the function FUN_131e8 - 0x132B4.