CVE-2026-45785

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45785
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45785.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45785
Aliases
Published
2026-07-17T20:37:23.428Z
Modified
2026-07-25T03:56:23.097184799Z
Severity
  • 6.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
OpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on crafted CFB directory cycle
Details

OpenMcdf is a fully .NET / C# library to manipulate Compound File Binary File Format files, also known as Structured Storage. In 3.1.3 and earlier, the BST name-lookup loop in DirectoryTree.TryGetDirectoryEntry (OpenMcdf/DirectoryTree.cs:35-46) walks directory entries by repeatedly calling directories.TryGetSibling(child, siblingType, validateColor). A crafted CFB file with cyclic Left/Right sibling links among directory entries, constructed so the per-step BST-order check in TryGetSibling (DirectoryEntries.cs:84-85) is satisfied at every step, drives this while (child is not null) loop forever. There is no cycle detection in TryGetDirectoryEntry, and the bug is reachable from RootStorage.OpenStorage(name), TryOpenStorage(name), OpenStream(name), and TryOpenStream(name), causing an unrecoverable denial of service. This issue is fixed in version 3.1.4.

Database specific 
{
    "cwe_ids": [
        "CWE-835"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45785.json"
}
References

Affected packages

Git / github.com/openmcdf/openmcdf

Affected ranges

Type
GIT
Repo
https://github.com/openmcdf/openmcdf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c6f82db722bd85db7b0caed3ca1aa374f1e07bc7
Fixed
11ffb7cafff6eea99639df6b2b249dcf6bcca3ef
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.1.4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v2.*
v2.1.1.29598
v2.1.2.1274
v2.1.3.34720
v2.1.3.34730
v2.1.4.23498
v2.1.5.22659
v2.1.6.28924
v2.2.1.2
v2.2.1.3
v2.2.1.4
v2.2.1.5
v2.2.1.6
v2.2.1.9
v2.3.0.0
v2.3.1.0
v3.*
v3.0.0
v3.0.0-preview.1
v3.0.0-preview.2
v3.0.0-preview.3
v3.0.0-preview.4
v3.0.0-preview.5
v3.0.1
v3.0.2
v3.0.2-alpha.1
v3.0.3
v3.1.0
v3.1.1
v3.1.2
v3.1.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45785.json"