CVE-2026-110600 json
xlsxio through 0.2.37 NULL Pointer Dereference via Worksheet Relationship Without Id
published 2026-10-14 25 d ago modified 2026-10-15 24 d ago also EUVD-2026-101228
- cvss
- 5.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 14%
- public exploits
- 0
- none known
Summary
xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in main_sheet_get_sheetfile_expat_callback_element_start() in lib/xlsxio_read.c that allows attackers to crash applications via crafted files. Attackers can supply a .xlsx file whose workbook.xml.rels contains a worksheet Relationship lacking an Id attribute, crashing the process when xlsxioread_sheet_open() is called.
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 25 d ago
Exploit prediction
0.24% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/brechtsanders/xlsxio/issues/151 referenced PoC, tagged "exploit" by a source, unverified
- hackmd.io https://hackmd.io/@haind-pwn/xlsxio-relationship-missing-id-null-deref referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.8 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
| CNA | 4.0 | 6.8 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- brechtsanders xlsxio
Classification
- Weakness
-
- CWE-476 NULL Pointer Dereference
References
-
github.com
/brechtsanders/xlsxio/issues/151
issue-tracking, exploit
-
hackmd.io
/@haind-pwn/xlsxio-relationship-missing-id-null-deref
third-party-advisory, exploit
-
github.com
/brechtsanders/xlsxio/blob/0.2.37/lib/xlsxio_read.c#L851-L866
technical-description
-
vulncheck.com
/advisories/xlsxio-through-0.2.37-null-pointer-dereference-via-worksheet-relationship-without-id
third-party-advisory
Sources
- CVE List CVE-2026-110600
- NVD CVE-2026-110600
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.