RUSTSEC-2026-0436

The Compound File Binary (OLE2) parser (src/cfb.rs), used when reading .xls and .xlsb workbooks and when extracting VBA projects from .xlsx, can panic or allocate without bound on crafted input. Both are reachable through the public reader API (open_workbook, Xls::new, Xlsb::new) on an attacker-supplied file. Impact is denial of service only — no memory unsafety (safe Rust turns the out-of-bounds read into a bounds-checked panic).

1. Reachable panic (out-of-bounds slice index). The directory stream is iterated with .chunks(128), but Directory::from_slice reads fixed offsets (buf[..64], buf[116..120], buf[120..128]) without checking the chunk length. A directory stream whose length is not a multiple of 128 yields a short final chunk, causing a panic (range end index 64 out of range for slice of length N). SectorSize::Small 64-byte mini sectors are a second trigger.

2. Unbounded allocation / OOM. The DIFAT loader grows the difat vector without bounding the number of iterations; a crafted self-referential DIFAT chain drives a multi-gigabyte allocation from a tiny file (a 512-byte file attempts an allocation of several gigabytes).

A consumer that parses untrusted or user-supplied spreadsheets can be crashed (thread panic, or process abort under panic=abort) or driven out of memory by a small crafted file.

Fixed in calamine 0.38.0 (commit b8ec4f0); the maintainer confirmed the fix in https://github.com/tafia/calamine/pull/762.