CVE-2026-3463

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A weakness has been identified in xlnt-community xlnt up to 1.6.1. Impacted is the function xlnt::detail::binary_writer::append of the file source/detail/binary.hpp of the component Compound Document Parser. This manipulation causes heap-based buffer overflow. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. Patch name: 147. It is suggested to install a patch to address this issue.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-122

Affected software

Vendor	Product	Versions
xlnt-community	xlnt	1.6.0; 1.6.1

References

https://github.com/oneafter/0128/blob/main/xl2/reproExploit
https://github.com/xlnt-community/xlnt/Product
https://github.com/xlnt-community/xlnt/issues/138Exploit, Issue Tracking, Vendor Advisory
https://github.com/xlnt-community/xlnt/issues/138#issuecomment-3868381672Issue Tracking
https://github.com/xlnt-community/xlnt/pull/147Issue Tracking
https://vuldb.com/?ctiid.348530Permissions Required, VDB Entry
https://vuldb.com/?id.348530Third Party Advisory, VDB Entry
https://vuldb.com/?submit.764643Third Party Advisory, VDB Entry

Timeline

Published: Mar 3, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-346307.8Bridge versions 16.0.2, 15.1.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code ex CVE-2026-346317.8InCopy versions 20.5.2, 21.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution CVE-2026-346328.6Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execu CVE-2026-346337.7ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged att CVE-2026-346348.6ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this CVE-2026-346358.4is affected by a Use of Hard-coded Cryptographic Key vulnerability that could result in a Security feature bypass. A low-privileged attacker CVE-2026-346367.8Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code ex CVE-2026-346377.8Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code ex CVE-2026-346387.8Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code executio CVE-2026-346397.8Media Encoder versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code e CVE-2026-34648.8The WP Customer Area plugin for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation in the CVE-2026-346407.8Media Encoder versions 26.0.2, 25.6.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbit