# CVE-2026-79591: libxls heap-buffer-overflow and use-after-free in xls_getCSS

Source: https://junglewise.ai/threats/cve-2026-79591-libxls-heap-buffer-overflow-and-use-after-free-in-xls-getcss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-79591 · Severity: high · CVSS 7.8 · Published 2026-09-10

libxls is a library used by applications to read Excel spreadsheet files in the legacy XLS format. A flaw in the CSS generation function allows a specially crafted XLS file to trigger out-of-bounds memory access, potentially exposing sensitive data from memory or crashing the application that uses libxls.

Technologies: [Libxls](https://junglewise.ai/threats/technologies/libxls). Vendors: [Libxls](https://junglewise.ai/threats/vendors/libxls).

## Quick answers

**Is CVE-2026-79591 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79591 being exploited in the wild.

**How severe is CVE-2026-79591?** High severity, with a CVSS score of 7.8, published 10 September 2026.

**Which products and versions are affected?** Libxls 1.6.3.

**Is there a fix for CVE-2026-79591?** A patch was published on 2026-08-21: Fix merged in PR #164 validating font indices when generating CSS Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-79591 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-79591?** Check whether you run Libxls at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-buffer-overflow and use-after-free vulnerability exists in the xls_getCSS() function due to insufficient validation of a file-controlled font index. The xf->font field, copied directly from the BIFF XF record without bounds checking, is used as an index into the font array. An out-of-range or zero value can cause out-of-bounds reads, including underflow when xf->font is 0. The vulnerability is triggered via the public API chain xls_open_buffer() → xls_summaryInfo() → xls_getCSS() → xls_parseWorkSheet() when processing a malicious XLS file. An attacker can achieve information disclosure or denial of service. A patch validating font indices was merged on 2026-08-21.

## Affected products

- libxls libxls 1.6.3

## Timeline

- 2026-09-10: disclosed
- 2026-08-21: patched: Fix merged in PR #164 validating font indices when generating CSS

## References

- [https://github.com/libxls/libxls/issues/161](https://github.com/libxls/libxls/issues/161)
- [https://github.com/libxls/libxls/pull/164/changes/902c8f9b13710c3a13b6232fb86626c5c729402c](https://github.com/libxls/libxls/pull/164/changes/902c8f9b13710c3a13b6232fb86626c5c729402c)

## Related threats

- [libxls out-of-bounds read in xls_dumpSummary](https://junglewise.ai/threats/cve-2026-79592-libxls-out-of-bounds-read-in-xls-dumpsummary)
- [libxls use-of-uninitialized memory in xls_parseWorkBook](https://junglewise.ai/threats/cve-2026-26825-libxls-use-of-uninitialized-memory-in-xls-parseworkbook)
- [libxls use of uninitialized memory in OLE container parser](https://junglewise.ai/threats/cve-2026-26824-libxls-use-of-uninitialized-memory-in-ole-container-parser)