CVE-2026-128344 | ExcelJS up to 4.4.0 Image Anchor xl/drawings/drawing1.xml getImages memory allocation

November 13, 2026 Yanac

A vulnerability marked as problematic has been reported in ExcelJS up to 4.4.0. Affected is the function getImages of the file xl/drawings/drawing1.xml of the component Image Anchor. Performing a manipulation results in uncontrolled memory allocation.

This vulnerability is reported as CVE-2026-128344. The attack is possible to be carried out remotely. No exploit exists.VulDB Recent EntriesRead More