AIKIDO-2026-255817

TL;DR

The OLE reader used by the XLS reader follows sector chains from attacker-controlled OLE metadata without detecting cycles or bounding the chain length. A tiny malformed .xls/OLE file can point the small-block depot sector chain back to itself, causing the reader to append the same sector data repeatedly until memory is exhausted. This is reachable during automatic file-type detection in canRead(), so untrusted uploads can trigger denial of service. The fix tracks visited blocks and throws a reader exception when a loop is detected.