CVE-2023-34795

HighCVSS 7.8

Published: 16/06/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

27th percentile - higher than 27% of all known CVEs

Summary

xlsxio versions from 0.1.2 to 0.2.34 contain a flaw related to an uninitialized pointer in the xlsxioread_sheetlist_close() function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted XLSX file.

Risk Assessment

Organizations may experience service outages related to the processing of XLSX files, potentially leading to data loss or disruption of operations.

Recommendation

It is recommended to upgrade to the latest version of xlsxio to mitigate this vulnerability and to monitor systems for potential DoS attacks.

Other vulnerabilities in xlsxio

CVE-2026-110600Medium
xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in main_sheet_get_sheetfile_expat_callback_element_start() in lib/xlsxio_read.c that allows attackers to crash applications via crafted files. Attackers can supply a .xlsx file whose workbook.xml.rels contains a worksheet Relationship lacking an Id attribute, crashing the process when xlsxioread_sheet_open() is called.

Original NVD description (English source)

xlsxio v0.1.2 to v0.2.34 was discovered to contain a free of uninitialized pointer in the xlsxioread_sheetlist_close() function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted XLSX file.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS