CVE-2026-3663

low-risk

Published 2026-03-07

A vulnerability was found in xlnt-community xlnt up to 1.6.1. This issue affects the function xlnt::detail::compound_document_istreambuf::xsgetn of the file source/detail/cryptography/compound_document.cpp of the component XLSX File Parser. Performing a manipulation results in out-of-bounds read. The attack is only possible with local access. The exploit has been made public and could be used. The patch is named 147. It is recommended to apply a patch to fix this issue.

Do I need to act?

0.02% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 3.3/10 Low

LOCAL / LOW complexity

Affected Products (1)

Xlnt

Affected Vendors

Xlnt-Community

References (7)

Exploit https://github.com/oneafter/0128/blob/main/xl3/repro

Product https://github.com/xlnt-community/xlnt/

Exploit https://github.com/xlnt-community/xlnt/issues/139

Issue Tracking https://github.com/xlnt-community/xlnt/pull/147

Permissions Required https://vuldb.com/?ctiid.349552

Third Party Advisory https://vuldb.com/?id.349552

Third Party Advisory https://vuldb.com/?submit.764644

/ 100

low-risk

Severity 13/34 · Low

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal