On 11 September 2026 at 18:56, Moritz Mühlenhoff wrote:
| Source: r-cran-readxl
| X-Debbugs-CC: team@security.debian.org
| Severity: important
| Tags: security
|
| Hi,
|
| The following vulnerabilities were published for libxls, which
| r-cran-readxl embeds:
|
|
| CVE-2026-79591[0]:
| | A heap-buffer-overflow and use-after-free vulnerability exists in
| | the xls_getCSS() function of libxls 1.6.3 due to insufficient
| | validation of a file-controlled font index.
|
| https://github.com/libxls/libxls/issues/161
| https://github.com/libxls/libxls/pull/164/changes/902c8f9b13710c3a13b6232fb86626c5c729402c
|
|
| CVE-2026-79592[1]:
| | An out-of-bounds read vulnerability exists in the xls_dumpSummary()
| | function of libxls 1.6.3 due to insufficient validation of file-
| | controlled OLE summary offsets.
|
| https://github.com/libxls/libxls/issues/162
| https://github.com/libxls/libxls/pull/165/changes/6eed8bc1d51d6649faebab0184b21ab8768d8fa6
Thanks. This is on top of #1139808 which I forwarded upstream [1] -- for no
actual follow-up yet I can see. I added these there.
Dirk
[1] https://github.com/tidyverse/readxl/issues/795
|
|
| If you fix the vulnerabilities please also make sure to include the
| CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
|
| For further information see:
|
| [0] https://security-tracker.debian.org/tracker/CVE-2026-79591
| https://www.cve.org/CVERecord?id=CVE-2026-79591
| [1] https://security-tracker.debian.org/tracker/CVE-2026-79592
| https://www.cve.org/CVERecord?id=CVE-2026-79592
|
| Please adjust the affected versions in the BTS as needed.