CVE-2026-41034

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2026-41034", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-04-16T06:06:44.178Z", "datePublished": "2026-04-16T06:06:44.570Z", "dateUpdated": "2026-04-16T12:31:05.251Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ONLYOFFICE DocumentServer", "vendor": "Ascensio", "versions": [{"lessThan": "9.3.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via pictFmla.cbBufInCtlStm and other vectors), leading to an information leak and ASLR bypass."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-16T06:13:45.134Z"}, "references": [{"url": "https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T12:20:07.491049Z", "id": "CVE-2026-41034", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T12:31:05.251Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41034", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-16T12:20:07.491049Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T12:20:09.120Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Ascensio", "product": "ONLYOFFICE DocumentServer", "versions": [{"status": "affected", "version": "0", "lessThan": "9.3.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via pictFmla.cbBufInCtlStm and other vectors), leading to an information leak and ASLR bypass."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-16T06:13:45.134Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41034", "state": "PUBLISHED", "dateUpdated": "2026-04-16T12:31:05.251Z", "dateReserved": "2026-04-16T06:06:44.178Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-04-16T06:06:44.570Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ONLYOFFICE DocumentServer", "vendor": "Ascensio", "versions": [{"lessThan": "9.3.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via pictFmla.cbBufInCtlStm and other vectors), leading to an information leak and ASLR bypass."}, {"lang": "es", "value": "ONLYOFFICE DocumentServer anterior a la versi\u00f3n 9.3.0 tiene una desreferencia de puntero no confiable en el procesamiento/conversi\u00f3n de XLS (a trav\u00e9s de pictFmla.cbBufInCtlStm y otros vectores), lo que lleva a una fuga de informaci\u00f3n y un bypass de ASLR."}], "id": "CVE-2026-41034", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41034", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-16T12:20:07.491049Z", "version": "2.0.3"}}]}, "published": "2026-04-16T07:16:30.843", "references": [{"source": "cve@mitre.org", "url": "https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,9.3.0)"}}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 83.0, "source": "matching"}]}, "original": {"product": "ONLYOFFICE DocumentServer", "source": "cna", "vendor": "Ascensio"}, "product": "document_server", "vendor": "onlyoffice"}], "analysis": {"en": {"generated_at": "2026-04-16T08:52:59.230121+00:00", "value": {"mitigation_remediation": ["Upgrade ONLYOFFICE DocumentServer to 9.3.0 or later.", "If an upgrade is not immediately possible, block or disable XLS file uploads or the conversion feature to prevent exploitation.", "Implement input validation for XLS files and perform strict bounds checking to eliminate untrusted pointer dereferences, following secure coding practices."], "summary": {"action": "Patch", "impact": "Information Disclosure and ASLR Bypass"}, "threat_synthesis": {"affected_systems": "VERSIONS PRIOR TO 9.3.0 of Ascensio ONLYOFFICE DocumentServer are affected. The issue is present in the document conversion component handling XLS files.", "description_and_impact": "The vulnerability is an untrusted pointer dereference that occurs during XLS processing and conversion in ONLYOFFICE DocumentServer. This flaw allows attackers to read memory contents (information leak) and bypass Address Space Layout Randomization, potentially aiding further exploitation. It is a classic memory safety error marked as CWE\u2011125.", "risk_and_exploitability": "The CVSS score of 5 denotes moderate severity, while the lack of an EPSS score means current exploitation probability is unknown. The weakness does not require local privilege escalation; an attacker only needs to supply a crafted XLS file to the server. Because the flaw can subvert ASLR, attackers that discover it may combine it with other remote exploits. The vulnerability is not listed in the CISA KEV catalog."}}}}, "created": "2026-04-16T09:00:05.120348+00:00", "title": "Untrusted Pointer Dereference in ONLYOFFICE DocumentServer XLS Processing Causes Information Leak and ASLR Bypass", "updated": "2026-04-16T09:00:05.289492+00:00", "vendors": ["onlyoffice", "onlyoffice$PRODUCT$document_server"]}