{
  "aliases": [],
  "categories": [
    "denial-of-service"
  ],
  "crate": "calamine",
  "cves": [],
  "cvss": 0.0,
  "database_specific": {
    "severity": "high"
  },
  "date": "2026-10-28",
  "deb_packages": [
    {
      "crate_name": "calamine",
      "deb_name": "librust-calamine-dev",
      "version": "0.34.0+ds-1"
    },
    {
      "crate_name": "xleak",
      "deb_name": "xleak",
      "version": "0.2.6+dfsg-1+b1"
    }
  ],
  "description": "The Compound File Binary (OLE2) parser (`src/cfb.rs`), used when reading `.xls` and `.xlsb`\nworkbooks and when extracting VBA projects from `.xlsx`, can panic or allocate without bound\non crafted input. Both are reachable through the public reader API (`open_workbook`,\n`Xls::new`, `Xlsb::new`) on an attacker-supplied file. Impact is denial of service only — no\nmemory unsafety (safe Rust turns the out-of-bounds read into a bounds-checked panic).\n\n1. **Reachable panic (out-of-bounds slice index).** The directory stream is iterated with\n   `.chunks(128)`, but `Directory::from_slice` reads fixed offsets (`buf[..64]`,\n   `buf[116..120]`, `buf[120..128]`) without checking the chunk length. A directory stream\n   whose length is not a multiple of 128 yields a short final chunk, causing a panic\n   (`range end index 64 out of range for slice of length N`). `SectorSize::Small` 64-byte\n   mini sectors are a second trigger.\n\n2. **Unbounded allocation / OOM.** The DIFAT loader grows the `difat` vector without bounding\n   the number of iterations; a crafted self-referential DIFAT chain drives a multi-gigabyte\n   allocation from a tiny file (a 512-byte file attempts an allocation of several gigabytes).\n\nA consumer that parses untrusted or user-supplied spreadsheets can be crashed (thread panic,\nor process abort under `panic=abort`) or driven out of memory by a small crafted file.\n\nFixed in calamine 0.38.0 (commit [b8ec4f0](https://github.com/tafia/calamine/commit/b8ec4f0)); the maintainer confirmed the fix in https://github.com/tafia/calamine/pull/762.",
  "id": "RUSTSEC-2026-0436",
  "keywords": [
    "dos",
    "panic",
    "oom",
    "cfb",
    "ole2",
    "xls",
    "xlsb"
  ],
  "patched_versions": [
    ">=0.38.0"
  ],
  "source": "debian_rustsec",
  "title": "Panic and unbounded allocation (OOM) in the CFB/OLE2 parser on malformed input",
  "url": "https://github.com/tafia/calamine/pull/762"
}