CVE-2026-2703

Low

Description

A weakness has been identified in xlnt-community xlnt up to 1.6.1. Impacted is the function xlnt::detail::decode_base64 of the file source/detail/cryptography/base64.cpp of the component Encrypted XLSX File Parser. Executing a manipulation can lead to off-by-one. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This patch is called f2d7bf494e5c52706843cf7eb9892821bffb0734. Applying a patch is advised to resolve this issue.

SeverityLow

CVSS3.3

Exploit probability—

ProductXlnt

PublishedFeb 19, 2026

First seenFeb 19, 2026

Weakness typeCWE-193CWE-193 CWE-189CWE-189

How to fix

Patches

github.com/xlnt-community/xlnt/commit/f2d7bf494e5c52706843cf7eb9892821bffb0734

Affected products

Product	Affected versions	Fixed in
xlnt-community xlnt	v ≤ 1.6.1	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.