CVE-2026-111127

The catdoc utility (versions through 0.95 ) is vulnerable to an out-of-bounds read in the copy_unicode_string() function located in src/xlsparse.c. This flaw stems from an unchecked string character count , where an attacker can provide a crafted .xls file declaring 0xFFFF two-byte characters wit...

CVE-2026-111127 catdoc through 0.95 Out-of-Bounds Read via xls2csv copy_unicode_string

catdoc through 0.95 contains an out-of-bounds read vulnerability in copyunicodestring in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count. Attackers can supply a crafted .xls file declaring 0xFFFF two-byte characters in LABEL, STRING, or SST record...

EUVD-2026-102358

catdoc through 0.95 contains an out-of-bounds read vulnerability in copyunicodestring in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count. Attackers can supply a crafted .xls file declaring 0xFFFF two-byte characters in LABEL, STRING, or SST record...