External risk intelligence

Spreadsheet::XLSX Code Execution via Malicious XLSX Files.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-115943

This vulnerability exists in a Perl library used for parsing XLSX files. While it is network-reachable if an application processes user-supplied files, the library itself is a developer-focused tool or dependency rather than a public-facing service, gateway, or edge component. Public internet exposure is therefore uncommon and depends entirely on the specific implementation of the host application.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects the Spreadsheet::XLSX Perl library, which is used to parse Excel files. It allows an attacker to execute arbitrary Perl code by providing a specially crafted XLSX file. While the library itself is not a direct internet-facing service, its use in applications that process external files could expose systems to risk if not properly managed.

Code execution via Excel file parsing.
Potential for arbitrary code in file processing.
Confirm relevance and exposure in your systems.

Attack Path

How an attacker could exploit the issue

An attacker could craft a malicious XLSX file, which, when processed by an application using a vulnerable version of Spreadsheet::XLSX, could lead to arbitrary Perl code execution. The vulnerability lies in how the library evaluates number format conditions within the Excel file during parsing. This process involves evaluating strings derived from the workbook, creating an opportunity for attackers to inject and run their own code.

No specific access required.
String eval of number format conditions.
Arbitrary Perl code execution.

Live Threat

Current exploitation, exposure, and threat context

When processing specially crafted XLSX files, this vulnerability could allow arbitrary Perl code execution on systems running affected versions of the Spreadsheet::XLSX library. This could occur when parsing number format conditions within an XLSX file, potentially impacting data integrity and system operations.

Arbitrary Perl code execution.
Code execution via crafted XLSX files.
System compromise and data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Spreadsheet::XLSX library is a component developers use to parse Excel files. Owners of applications that process user-supplied XLSX files via this library must identify affected instances, determine business criticality, and confirm ownership for remediation. The initial practical step involves locating all deployments of the affected library to assess exposure.

Application owners are responsible for this vulnerability.
Verify processing of user-supplied XLSX files.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Spreadsheet::XLSX?

Spreadsheet::XLSX is a Perl library that developers integrate into their applications to read and parse Excel (.xlsx) files. It allows software to extract data from spreadsheet documents programmatically. Because it is a code-level dependency rather than a standalone application, it is typically used by custom-built systems, data processing pipelines, or web applications that handle file uploads from users.

How does CVE-2026-115943 lead to code execution?

This vulnerability is classified as CWE-95, or Improper Neutralization of Directives in Dynamically Evaluated Code. The library attempts to parse number formatting conditions—such as specific rules for how to display numbers—directly from the Excel file. It uses a string evaluation function to process these conditions, which allows an attacker to inject and execute arbitrary Perl commands instead of simple formatting instructions during the parsing process.

Do I need to worry about any XLSX file I open?

Not necessarily. The vulnerability is triggered specifically when the library processes an XLSX file containing malicious number format conditions. If you are using a standard Excel application to view your files, this specific Perl library vulnerability does not apply. The risk exists only when your automated application logic parses these specific formatting strings using a vulnerable version of the Spreadsheet::XLSX code library.

Why does Halo Surface Signal call this unlikely?

Halo Surface Signal notes that while the vulnerability is serious, the library is a background dependency rather than a public-facing service. The risk is not universal; it is highly dependent on how your specific application is implemented. Exposure is primarily a concern if your application is configured to automatically ingest and process XLSX files submitted by users over the internet, rather than being an internal-only tool.

How do I start addressing this CVE-2026-115943?

Your first step is to perform an inventory of your software stack to identify where the Spreadsheet::XLSX library is currently deployed. Once located, verify if your applications process files from untrusted or external sources. If they do, prioritize updating the library to version 0.19 or later, which addresses the unsafe evaluation of number formats.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.