Executive brief
OpenMcdf is a .NET library used to read and write Compound File Binary (CFB) files, a format commonly used by older Microsoft Office documents and other structured storage applications. A vulnerability in how the library processes these files allows a specially crafted file to trigger an infinite loop. This results in a denial-of-service condition where the application using the library becomes unresponsive and consumes excessive system resources, potentially crashing the service or requiring a full process restart.
Technical details
The vulnerability exists in OpenMcdf's handling of the directory entry red-black tree within Compound File Binary (CFB) documents. Specifically, the DirectoryTreeEnumerator and DirectoryTree.TryGetDirectoryEntry components do not track visited nodes during tree traversal. An attacker can provide a crafted CFB file containing a cycle in the LeftSiblingID or RightSiblingID chains. When an application calls Storage.EnumerateEntries() or Storage.OpenStream() on such a file, the library enters an infinite loop that consumes the calling thread's CPU and memory. Because the loop occurs within the library's internal logic and does not throw an exception, it cannot be caught by standard try/catch blocks. The issue is resolved in version 3.1.3 by implementing Brent's cycle detection algorithm.
Affected products
- openmcdf project OpenMcdf < 3.1.3
Timeline
- 2026-04-20: patched: Version 3.1.3 released with fix.
- 2026-04-20: advisory: GitHub Security Advisory GHSA-jxpf-xq2m-q525 published.
- 2026-05-08: disclosed: CVE-2026-41511 published.