CVE-2024-48877: wagner xls2csv Integer Overflow to Buffer Overflow

Vulnerability summary

CVE-2024-48877 is a high (CVSS 8.4) Integer Overflow to Buffer Overflow vulnerability in wagner xls2csv. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.6% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 02-06-2025
   PublishedVulnerability first disclosed.
2. 03-11-2025
   Last modifiedVulnerability information updated.

Description

A memory corruption vulnerability exists in the Shared String Table Record Parser implementation in xls2csv utility version 0.95. A specially crafted malformed file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

• CWE-680Integer Overflow to Buffer OverflowThe product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.