XLMMacroDeobfuscator

XLMMacroDeobfuscator XLMMacroDeobfuscator は、難読化されたXLMマクロ（Excel 4.0マクロとも呼ばれます）をデコードするために使用できます。内部のXLMエミュレータを利用して、マクロを完全に実行せず解釈します。 xls、xlsm、xlsbの各形式をサポートしています。 セルの抽出やその他の情報の取得には、xlsファイルには xlrd2、xlsbファイルには pyxlsb2、xlsmファイルには独自のパーサーをそれぞれ使用します。 XLM文法は xlm-macro-lark.template でも確認できます。 エミュレータのインストール 1...

XLS-to-DBatLoader-or-GuLoader-for-AgentTesla-variant

解析対象ファイル PCAPベース分析 | 日付: 2025-03-12 | 作成者: BlackOclock 目次 1. 分析概要 1.1 解析対象ファイル（PCAPのみ） 1.2 感染タイムラインとCVEマッピング 2. ネットワークトラフィック分析 2.1 プロトコル階層 – 全体像 2.2 Conversations – トップトーカーとデータ転送 2.3 Endpoints – Tx/Rx確認 2.4 HTTPエクスポートオブジェクト – 抽出ファイル 2.5 HTTP Containsフィルター – ステガノグラフィ確認 3. NetworkMiner分析 3.1...

Maldoc-Analysis

Maldoc-Analysis 2023年3月、新たなマルウェアとして特定されたサンプルが確認されました。そのマルウェアは拡張子.xlsおよび.docのファイルに由来し、「Bank Slip.xls」という名前で知られています。そのマルウェアの活動は、CVE-2017-11882およびCVE-2018-0802として知られる脆弱性に関連しています。...

JLSEC-2026-1298

Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the transcodelatin1toutf8 function in xlstool.c:296...

JLSEC-2026-1297

Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the xlsparseWorkBook function in xls.c:1015...

JLSEC-2026-1296

Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the unicodedecodewcstombs function in xlstool.c:266...

JLSEC-2026-1300

Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the getstring function in xlstool.c:411...

JLSEC-2026-1295

Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the xlsparseWorkBook function in xls.c:1018...

JLSEC-2026-1299

Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the getstring function in xlstool.c:395...

PT-2026-80537

Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the xls parseWorkBook function in xls.c:1018...

PT-2026-80541

Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the get string function in xlstool.c:395...

PT-2026-80536

An issue was discovered in libxls before and including 1.6.1 when reading Microsoft Excel files. A NULL pointer dereference vulnerability exists when parsing XLS cells in libxls/xls2csv.c:199. It could allow a remote attacker to cause a denial of service via crafted XLS file...

PT-2026-80538

Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the unicode decode wcstombs function in xlstool.c:266...

PT-2026-80539

Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the xls parseWorkBook function in xls.c:1015...

CVE-2026-59933

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE...

CVE-2026-59933 PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE...

CVE-2026-59933 PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE...

EUVD-2026-49930

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE...

CVE-2026-59933: Uncontrolled Resource Consumption

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE...

PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

Summary PhpSpreadsheet's OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection,...