At a glance
- Debian released an update addressing CVE-2026-115943.
- Debian 13 (trixie) running libspreadsheet-xlsx-perl 0.18-1 is affected.
- The vulnerability may cause denial of service or arbitrary code execution when processing specially crafted documents.
- Update the package to 0.20-0+deb13u1.
Debian updates libspreadsheet-xlsx-perl to fix CVE-2026-115943
Debian has released an update for libspreadsheet-xlsx-perl to fix CVE-2026-115943, which may cause denial of service or arbitrary code execution when processing specially crafted documents. Debian 13 (trixie) systems should upgrade from 0.18-1 to 0.20-0+deb13u1.
In this article
Debian has released an update for libspreadsheet-xlsx-perl, a Perl module for reading Microsoft Excel 2007 files, to address CVE-2026-115943. See the Debian security advisory for the source information.
Overview and technical details
The vulnerability may cause denial of service or arbitrary code execution when the module processes a specially crafted document.
| Field | Details |
|---|---|
| Product | libspreadsheet-xlsx-perl |
| CVE | CVE-2026-115943 |
| Source | Debian DSA |
Affected systems
| Product | Affected version | Fixed version |
|---|---|---|
| Debian 13 (trixie): libspreadsheet-xlsx-perl | 0.18-1 | 0.20-0+deb13u1 |
Mechanism and impact
The risk arises when the module processes a specially crafted document. The reported impacts are denial of service or arbitrary code execution.
System checks
Check the installed package version on Debian:
dpkg-query -W -f='${Version}\n' libspreadsheet-xlsx-perlCompare the installed version with the fixed threshold for trixie:
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libspreadsheet-xlsx-perl)" lt 0.20-0+deb13u1
Version 0.18-1 is below the fixed threshold and needs updating; version 0.20-0+deb13u1 or later meets the fix version specified for trixie.
Remediation and mitigation
Prioritize updating
libspreadsheet-xlsx-perlon Debian trixie to version0.20-0+deb13u1.
Related articles
Ubuntu Linux kernel for NVIDIA Tegra: check systems and apply security updates
Ubuntu USN-9091-1 warns of multiple vulnerabilities in the Linux kernel for NVIDIA Tegra. The supplied record gives no affected branches or fixed packages. Check installed kernels and packages, then consult the Ubuntu notice for the applicable update.
Debian trixie: update the Linux kernel to address multiple vulnerabilities
Debian DSA-6628-1 reports multiple Linux kernel vulnerabilities in Debian trixie that could lead to privilege escalation, denial of service, or information disclosure. Systems running linux 6.12.107-1 are affected; Debian recommends upgrading to 6.12.117-1.
Debian updates postgresql-17 on trixie: upgrade to 17.12-0+deb13u1
Debian DSA-6625-1 updates postgresql-17 on Debian trixie to address multiple vulnerabilities, including CVE-2026-6460. Reported risks include arbitrary code execution, authentication bypass, information disclosure, denial of service, and privilege escalation. Upgrade to 17.12-0+deb13u1 and…
Ubuntu Xenial: Update Debian-LAN to address Kerberos password-change risk
Ubuntu Xenial is affected by CVE-2019-3467 in Debian-LAN configuration: an authenticated user could change another user’s Kerberos credentials and escalate privileges. Check the debian-lan-config package and update to the fixed version in the esm-apps-legacy pocket.