rustsec-2026-0436
debian_rustsecThe Compound File Binary (OLE2) parser (`src/cfb.rs`), used when reading `.xls` and `.xlsb` workbooks and when extracting VBA projects from `.xlsx`, can panic or allocate without bound on crafted input. Both are reachable through the public reader API (`open_workbook`, `Xls::new`, `Xlsb::new`) on an attacker-supplied file. Impact is denial of service only — no memory unsafety (safe Rust turns the out-of-bounds read into a bounds-checked panic). 1. **Reachable panic (out-of-bounds slice index).** The directory stream is iterated with `.chunks(128)`, but `Directory::from_slice` reads fixed offsets (`buf[..64]`, `buf[116..120]`, `buf[120..128]`) without checking the chunk length. A directory stream whose length is not a multiple of 128 yields a short final chunk, causing a panic (`range end index 64 out of range for slice of length N`). `SectorSize::Small` 64-byte mini sectors are a second trigger. 2. **Unbounded allocation / OOM.** The DIFAT loader grows the `difat` vector without bounding the number of iterations; a crafted self-referential DIFAT chain drives a multi-gigabyte allocation from a tiny file (a 512-byte file attempts an allocation of several gigabytes). A consumer that parses untrusted or user-supplied spreadsheets can be crashed (thread panic, or process abort under `panic=abort`) or driven out of memory by a small crafted file. Fixed in calamine 0.38.0 (commit [b8ec4f0](https://github.com/tafia/calamine/commit/b8ec4f0)); the maintainer confirmed the fix in https://github.com/tafia/calamine/pull/762.
- Published
- unknown
- Last Modified
- unknown
CVSS details not available.
No product information available.
No references available.
No linked vulnerabilities found.
{
"aliases": [],
"categories": [
"denial-of-service"
],
"crate": "calamine",
"cves": [],
"cvss": 0.0,
"database_specific": {
"severity": "high"
},
"date": "2026-10-28",
"deb_packages": [
{
"crate_name": "calamine",
"deb_name": "librust-calamine-dev",
"version": "0.34.0+ds-1"
},
{
"crate_name": "xleak",
"deb_name": "xleak",
"version": "0.2.6+dfsg-1+b1"
}
],
"description": "The Compound File Binary (OLE2) parser (`src/cfb.rs`), used when reading `.xls` and `.xlsb`\nworkbooks and when extracting VBA projects from `.xlsx`, can panic or allocate without bound\non crafted input. Both are reachable through the public reader API (`open_workbook`,\n`Xls::new`, `Xlsb::new`) on an attacker-supplied file. Impact is denial of service only — no\nmemory unsafety (safe Rust turns the out-of-bounds read into a bounds-checked panic).\n\n1. **Reachable panic (out-of-bounds slice index).** The directory stream is iterated with\n `.chunks(128)`, but `Directory::from_slice` reads fixed offsets (`buf[..64]`,\n `buf[116..120]`, `buf[120..128]`) without checking the chunk length. A directory stream\n whose length is not a multiple of 128 yields a short final chunk, causing a panic\n (`range end index 64 out of range for slice of length N`). `SectorSize::Small` 64-byte\n mini sectors are a second trigger.\n\n2. **Unbounded allocation / OOM.** The DIFAT loader grows the `difat` vector without bounding\n the number of iterations; a crafted self-referential DIFAT chain drives a multi-gigabyte\n allocation from a tiny file (a 512-byte file attempts an allocation of several gigabytes).\n\nA consumer that parses untrusted or user-supplied spreadsheets can be crashed (thread panic,\nor process abort under `panic=abort`) or driven out of memory by a small crafted file.\n\nFixed in calamine 0.38.0 (commit [b8ec4f0](https://github.com/tafia/calamine/commit/b8ec4f0)); the maintainer confirmed the fix in https://github.com/tafia/calamine/pull/762.",
"id": "RUSTSEC-2026-0436",
"keywords": [
"dos",
"panic",
"oom",
"cfb",
"ole2",
"xls",
"xlsb"
],
"patched_versions": [
">=0.38.0"
],
"source": "debian_rustsec",
"title": "Panic and unbounded allocation (OOM) in the CFB/OLE2 parser on malformed input",
"url": "https://github.com/tafia/calamine/pull/762"
}