{"id":"EUVD-2026-28813","revision":"1f9e363b76c14db19adb8a8398252b90","records":[{"revision":"1f9e363b76c14db19adb8a8398252b90","observedAt":"2026-10-28T05:10:08.473+00:00","statement":{"source":"euvd","id":"EUVD-2026-28813","aliases":["CVE-2026-41511","GHSA-jxpf-xq2m-q525"],"title":"OpenMcdf is a fully .NET / C# library to manipulate Compound File Binary File Format files, also known as Structured Storage. Prior to version 3.1.3, OpenMcdf does not detect cycles in the directory entry red-black tree of a Compound File B…","description":"OpenMcdf is a fully .NET / C# library to manipulate Compound File Binary File Format files, also known as Structured Storage. Prior to version 3.1.3, OpenMcdf does not detect cycles in the directory entry red-black tree of a Compound File Binary (CFB) document. A crafted CFB file with a cycle in the LeftSiblingID / RightSiblingID chain causes Storage.EnumerateEntries() and Storage.OpenStream() to loop indefinitely, consuming the calling thread with no possibility of recovery via try/catch. This issue has been patched in version 3.1.3.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":6.2,"severity":null}],"references":["https://github.com/openmcdf/openmcdf/security/advisories/GHSA-jxpf-xq2m-q525","https://github.com/openmcdf/openmcdf/commit/24f445a557fc4f46461cf6d02d296cce16c293a0","https://github.com/openmcdf/openmcdf/releases/tag/v3.1.3"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-28813","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 8, 2026, 6:52:39 PM","dateUpdated":"May 11, 2026, 6:45:06 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-28813","identifiers":["EUVD-2026-28813","CVE-2026-41511","GHSA-jxpf-xq2m-q525"]},"retained":false,"historicalAffected":[]}],"coverage":[]}