A critical out-of-bounds read vulnerability in libxls version 1.6.3 exposes sensitive memory data to unauthenticated attackers, posing a significant risk of information disclosure.

This vulnerability is an out-of-bounds read flaw located within the xls_dumpSummary function, which fails to properly validate file-controlled OLE summary offsets. An unauthenticated attacker can trigger this condition by providing a maliciously crafted file to the application.

The ability to perform an out-of-bounds read can lead to the unauthorized disclosure of sensitive information residing in memory. With a CVSS score of 7.5, this high-severity vulnerability represents a substantial risk of data compromise, which could lead to further exploitation of the host system or exposure of proprietary data.

Immediate Action: Organizations using libxls 1.6.3 should audit their dependency usage and monitor for the availability of a stable patch from the official libxls repository.

Proactive Monitoring: Security teams should monitor system logs for application crashes or abnormal memory usage patterns associated with parsing XLS files.

Compensating Controls: Deploy file integrity monitoring and restrict the processing of untrusted or externally sourced Excel files to isolated, sandboxed environments to limit potential exposure.

Public Exploit Available: No confirmed public exploit (Metasploit or ExploitDB) is available at this time.

Given the potential for unauthorized data access and the existence of a proof-of-concept, this vulnerability warrants immediate attention. Organizations should prioritize updating their software stack as soon as a fix is released by the vendor and should isolate any systems currently processing untrusted XLS files until the patch is verified and applied.