CVE-2024-48877 - A memory corruption vulnerability exists in the Shared String Table Record Parser implementation in xls2csv utility version 0.95

Back Back to CVE browser

HIGH

A memory corruption vulnerability exists in the Shared String Table Record Parser implementation in xls2csv utility version 0.95

Published Jun 2, 2025

8.4

HIGH

CVSS 3.1

EPSS 0.32%

Description

A memory corruption vulnerability exists in the Shared String Table Record Parser implementation in xls2csv utility version 0.95. A specially crafted malformed file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

Affected products

Vendor Xls2csv Product Xls2csv Default
n/a
- Version
  0.95
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Xls2csv

n/a

Version	Status	Constraints
0.95	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-680

CWE-787

Out-of-bounds Write

References (3)

https://lists.debian.org/debian-lts-announce/2025/06/msg00032.html
https://talosintelligence.com/vulnerability_reports/TALOS-2024-2128
ExploitThird Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2128
ExploitThird Party Advisory

Link	Providers	Tags
https://lists.debian.org/debian-lts-announce/2025/06/msg00032.html
https://talosintelligence.com/vulnerability_reports/TALOS-2024-2128		ExploitThird Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2128		ExploitThird Party Advisory