CVE-2026-41511: OpenMcdf has an Infinite loop DoS via crafted CFB directory cycle

April 22, 2026 (updated May 13, 2026)

OpenMcdf does not detect cycles in the directory entry red-black tree of a Compound File Binary (CFB) document. A crafted CFB file with a cycle in the LeftSiblingID / RightSiblingID chain causes Storage.EnumerateEntries() and Storage.OpenStream() to loop indefinitely, consuming the calling thread with no possibility of recovery via try/catch.

References

github.com/advisories/GHSA-jxpf-xq2m-q525
github.com/openmcdf/openmcdf/commit/24f445a557fc4f46461cf6d02d296cce16c293a0
github.com/openmcdf/openmcdf/releases/tag/v3.1.3
github.com/openmcdf/openmcdf/security/advisories/GHSA-jxpf-xq2m-q525
nvd.nist.gov/vuln/detail/CVE-2026-41511

Code Behaviors & Features

Detect and mitigate CVE-2026-41511 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →