CVE-2026-3463

Low

Description

A weakness has been identified in xlnt-community xlnt up to 1.6.1. Impacted is the function xlnt::detail::binary_writer::append of the file source/detail/binary.hpp of the component Compound Document Parser. This manipulation causes heap-based buffer overflow. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. Patch name: 147. It is suggested to install a patch to address this issue.

SeverityLow

CVSS3.3

Exploit probability—

ProductXlnt

PublishedMar 3, 2026

First seenMar 3, 2026

Weakness typeCWE-122CWE-122 CWE-119Memory buffer bounds error

How to fix

Patches

github.com/xlnt-community/xlnt/pull/147

Affected products

Product	Affected versions	Fixed in
xlnt-community xlnt	v ≤ 1.6.1	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.