CVE-2026-125264

A flaw was found in FFmpeg. A CPU exhaustion issue can occur in the JPEG XL parser when processing a specially crafted JPEG XL file due to a failure to validate TOC Table of Contents entry counts against the remaining input. This vulnerability can lead to an excessive consumption of CPU resources...

CVE-2026-128342

ExcelJS through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying an unbounded sheetId in xl/workbook.xml. Attackers can provide a workbook with a huge sheetId, making the sparse worksheet array walk stall worksheets, getWorksheet and...

CVE-2026-128340

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal...

CVE-2026-128344

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an unbounded image anchor column in the drawing part. Attackers can set an anchor column such as 300000000 in xl/drawings/drawing1.xml so reading getImages...

CVE-2026-128336

ExcelJS through 4.4.0 contains a prototype pollution vulnerability that allows attackers to add numeric keys to Object.prototype through a crafted defined name referencing a proto sheet. Attackers can supply an xlsx whose xl/workbook.xml definedName range targets proto, causing CellMatrix to writ...

CVE-2026-128336

The ExcelJS library (through version 4.4.0 ) is vulnerable to a prototype pollution vulnerability. An attacker can supply a crafted xlsx file where the xl/workbook.xml definedName range targets proto . When workbook.xlsx.load() is executed, the CellMatrix component writes empty arrays onto Object...

CVE-2026-128336 ExcelJS through 4.4.0 Prototype Pollution via __proto__ Defined Name

ExcelJS through 4.4.0 contains a prototype pollution vulnerability that allows attackers to add numeric keys to Object.prototype through a crafted defined name referencing a proto sheet. Attackers can supply an xlsx whose xl/workbook.xml definedName range targets proto, causing CellMatrix to writ...

EUVD-2026-125041

ExcelJS through 4.4.0 contains a prototype pollution vulnerability that allows attackers to add numeric keys to Object.prototype through a crafted defined name referencing a proto sheet. Attackers can supply an xlsx whose xl/workbook.xml definedName range targets proto, causing CellMatrix to writ...

CVE-2026-128340 ExcelJS through 4.4.0 Memory Exhaustion via Oversized Defined Name Range

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal...

EUVD-2026-125037

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal...

CVE-2026-128340

The ExcelJS library, versions through 4.4.0 , is vulnerable to a memory exhaustion flaw. The issue resides in the DefinedNames.addEx function, which processes oversized defined-name ranges from xl/workbook.xml (e.g., S!$A$1:$XFD$1048576) by expanding them cell by cell. This behavior triggers an u...

EUVD-2026-125157

ExcelJS through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying an unbounded sheetId in xl/workbook.xml. Attackers can provide a workbook with a huge sheetId, making the sparse worksheet array walk stall worksheets, getWorksheet and...

CVE-2026-128342

The ExcelJS library (versions through 4.4.0 ) is vulnerable to a Denial of Service (DoS) attack due to an unchecked input for loop conditions (CWE-606 ). An attacker can provide a workbook containing a large, unbounded sheetId in the xl/workbook.xml file. This causes the sparse worksheet array wa...

CVE-2026-128344

The ExcelJS library (through version 4.4.0 ) is vulnerable to a memory exhaustion (CWE-770) flaw. An attacker can crash applications by providing a workbook containing an unbounded image anchor column within the drawing part (e.g., setting an anchor column like 300000000 in xl/drawings/drawing1.x...

EUVD-2026-125155

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an unbounded image anchor column in the drawing part. Attackers can set an anchor column such as 300000000 in xl/drawings/drawing1.xml so reading getImages...

CVE-2026-128344 ExcelJS through 4.4.0 Memory Exhaustion via Oversized Image Anchor Column

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an unbounded image anchor column in the drawing part. Attackers can set an anchor column such as 300000000 in xl/drawings/drawing1.xml so reading getImages...

EUVD-2026-125152

ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to read local files by supplying crafted image filenames to addImage. Attackers can inject ../ path segments into user-controlled image paths, causing addMedia to embed any fi...

CVE-2026-125264 FFmpeg through 9.0.2 CPU Exhaustion via JPEG XL Parser TOC Count

FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in parseframeheader in libavcodec/jpegxlparser.c that fails to validate TOC entry counts against remaining input. Attackers can supply a crafted JPEG XL frame header with a permuted TOC and huge toccount, making the...

CVE-2026-125264 FFmpeg through 9.0.2 CPU Exhaustion via JPEG XL Parser TOC Count

FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in parseframeheader in libavcodec/jpegxlparser.c that fails to validate TOC entry counts against remaining input. Attackers can supply a crafted JPEG XL frame header with a permuted TOC and huge toccount, making the...

Mirage: Targeted Jailbreaks against Post-Generation Safety Checkers in Multimodal Diffusion Models

Post-generation safety checkers are widely employed in diffusion-model pipelines to prevent unsafe generated content from reaching users. In this paper, we show that these safety checkers can still be bypassed by our proposed multimodal jailbreak attack, Mirage. Given an adversarial target, which...