{"aliases":[],"categories":["denial-of-service"],"crate":"calamine","cves":[],"cvss":0.0,"database_specific":{"severity":"high"},"date":"2026-10-28","deb_packages":[{"crate_name":"calamine","deb_name":"librust-calamine-dev","version":"0.34.0+ds-1"},{"crate_name":"xleak","deb_name":"xleak","version":"0.2.6+dfsg-1+b1"}],"description":"The Compound File Binary (OLE2) parser (`src/cfb.rs`), used when reading `.xls` and `.xlsb`\nworkbooks and when extracting VBA projects from `.xlsx`, can panic or allocate without bound\non crafted input. Both are reachable through the public reader API (`open_workbook`,\n`Xls::new`, `Xlsb::new`) on an attacker-supplied file. Impact is denial of service only — no\nmemory unsafety (safe Rust turns the out-of-bounds read into a bounds-checked panic).\n\n1. **Reachable panic (out-of-bounds slice index).** The directory stream is iterated with\n   `.chunks(128)`, but `Directory::from_slice` reads fixed offsets (`buf[..64]`,\n   `buf[116..120]`, `buf[120..128]`) without checking the chunk length. A directory stream\n   whose length is not a multiple of 128 yields a short final chunk, causing a panic\n   (`range end index 64 out of range for slice of length N`). `SectorSize::Small` 64-byte\n   mini sectors are a second trigger.\n\n2. **Unbounded allocation / OOM.** The DIFAT loader grows the `difat` vector without bounding\n   the number of iterations; a crafted self-referential DIFAT chain drives a multi-gigabyte\n   allocation from a tiny file (a 512-byte file attempts an allocation of several gigabytes).\n\nA consumer that parses untrusted or user-supplied spreadsheets can be crashed (thread panic,\nor process abort under `panic=abort`) or driven out of memory by a small crafted file.\n\nFixed in calamine 0.38.0 (commit [b8ec4f0](https://github.com/tafia/calamine/commit/b8ec4f0)); the maintainer confirmed the fix in https://github.com/tafia/calamine/pull/762.","id":"RUSTSEC-2026-0436","keywords":["dos","panic","oom","cfb","ole2","xls","xlsb"],"patched_versions":[">=0.38.0"],"source":"debian_rustsec","title":"Panic and unbounded allocation (OOM) in the CFB/OLE2 parser on malformed input","url":"https://github.com/tafia/calamine/pull/762"}