RSEC-2023-2
Denial of Service (DoS) vulnerability
Published Jul 13, 2023 · updated May 19, 2025
The readxl R package is exposed to a vulnerability owing to its underlying use of libxls library version 1.6.2. The vulnerability originates in the xls_getWorkSheet function within xls.c in libxls. Attackers can exploit this flaw by utilizing a specially crafted XLS file, leading to a Denial of Service (DoS) attack.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Jul 13, 2023 · OSV.dev
Detected
The readxl R package is exposed to a vulnerability owing to its underlying use of libxls library version 1.6.2. The vulnerability originates in the xls_getWorkSheet function within xls.c in libxls. Attackers can exploit this flaw by utilizing a specially crafted XLS file, leading to a Denial of Service (DoS) attack.
May 19, 2025 · OSV.dev
Fix available
readxl fixed in 1.4.2
May 19, 2025 · OSV.dev
Fix available
readxl fixed in 1.4.2
May 19, 2025 · OSV.dev
Updated
The readxl R package is exposed to a vulnerability owing to its underlying use of libxls library version 1.6.2. The vulnerability originates in the xls_getWorkSheet function within xls.c in libxls. Attackers can exploit this flaw by utilizing a specially crafted XLS file, leading to a Denial of Service (DoS) attack.
Affected
- CRAN readxl1.4.1 → 1.4.2