CVE-2021-32012

Vulnerability

SheetJS and SheetJS Pro through version 0.16.9 are susceptible to a denial of service (memory exhaustion) vulnerability when processing a specially crafted .xlsx file. The issue is triggered during the parsing of workbook structures in the library's xlsx.js component. No special configuration is required beyond the library's default parsing behavior; any application using SheetJS to read user-supplied Excel documents is affected [1].

Exploitation

An attacker needs only to provide a malicious .xlsx file to an application that parses it with SheetJS. The crafted document contains structures that trigger excessive memory allocation during parsing. No authentication, network position, or user interaction aside from triggering the file parse operation is required [2].

Impact

Successful exploitation results in a denial of service condition due to uncontrolled memory consumption, impacting application availability. The attack does not lead to information disclosure, privilege escalation, or code execution; the sole outcome is resource exhaustion that may crash the hosting process or degrade system performance [1].

Mitigation

The vulnerability is fixed in SheetJS version 0.16.9 and later. Users should update to the latest release. As a workaround, organizations can limit the size and complexity of uploaded .xlsx files, or employ external scanning tools to detect malformed documents before they reach the library. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog [1][2][3].