PatchTheCVElibxls vulnerabilities and fixes
Recent CVEs affecting libxls, with upgrade or downgrade steps. 2 tracked.
libxls has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2026-06-03. Highest priority: CVE-2026-26824 (score 38/100).
- CVE-2026-26825 MEDIUM 5.3 DOWNGRADE A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files
- CVE-2026-26824 MEDIUM 6.5 UPGRADE libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser
FAQ
How do I fix libxls vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is libxls being exploited right now?
None of the tracked libxls CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which libxls CVE should I patch first?
CVE-2026-26824 currently ranks highest (38/100): libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser.