CVE-2018-20452: Improper Restriction of Operations within the Bounds of a Memory Buffer

The readMSATbody function in ole.c in libxls 1.4.0 has an invalid free that allows attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted file, because of inconsistent memory management new versus free in ole2readheader in ole.c...