CVE-2026-3665

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A vulnerability was identified in xlnt-community xlnt up to 1.6.1. The affected element is the function xlnt::detail::xlsx_consumer::read_office_document of the file source/detail/serialization/xlsx_consumer.cpp of the component XLSX File Parser. The manipulation leads to null pointer dereference. The attack must be carried out locally. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-404 CWE-476

Affected software

Vendor	Product	Versions
xlnt-community	xlnt	1.6.0; 1.6.1

References

https://github.com/oneafter/0128/blob/main/xl4/reproExploit
https://github.com/xlnt-community/xlnt/Product
https://github.com/xlnt-community/xlnt/issues/140Exploit, Issue Tracking, Vendor Advisory
https://vuldb.com/?ctiid.349554Permissions Required, VDB Entry
https://vuldb.com/?id.349554Third Party Advisory, VDB Entry
https://vuldb.com/?submit.764647Third Party Advisory, VDB Entry

Timeline

Published: Mar 7, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-36668.8The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 2.4.16. This is due to CVE-2026-366699.8An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11.13.11 allows remote attackers to upload CVE-2026-36675.3A security flaw has been discovered in Freedom Factory dGEN1 up to 20260221. The impacted element is the function FakeAppService of the comp CVE-2026-366708.8A Time-Based Blind SQL Injection vulnerability in the alias_management module of OpenSIPS Control Panel (opensips-cp) prior to version 9.3.3 CVE-2026-36683.1A weakness has been identified in Freedom Factory dGEN1 up to 20260221. This affects the function AndroidEthereum of the component org.ethos CVE-2026-36695.3A security vulnerability has been detected in Freedom Factory dGEN1 up to 20260221. This impacts the function AlarmService of the component CVE-2026-366988.8Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in /sb CVE-2026-36705.3A vulnerability was detected in Freedom Factory dGEN1 up to 20260221. Affected is an unknown function of the component com.dgen.alarm. Perfo CVE-2026-36713.3A flaw has been found in Freedom Factory dGEN1 up to 20260221. Affected by this vulnerability is the function TokenBalanceContentProvider of CVE-2026-367197.5An information disclosure vulnerability in the /api/v1/user/info endpoint of AgentChat v2.3.0 allows unauthenticated attackers to obtain sen CVE-2026-36726.3A vulnerability has been found in JeecgBoot up to 3.9.1. Affected is the function isExistSqlInjectKeyword of the file /jeecg-boot/sys/api/ge CVE-2026-367208.1Insecure permissions in bookcars v8.3 allows authenticated attackers to escalate privileges from user to admin via modifying their user type