What is CVE-2026-41034?

CVE-2026-41034 is a medium-severity vulnerability in Ascensio Onlyoffice Documentserver, classified under Out-of-bounds Read. CVSS score: 5.0/10. Published 2026-04-16.

How severe is CVE-2026-41034?

Medium severity. CVSS v3 base score is 5.0 out of 10.

Out-of-bounds Read in Ascensio Onlyoffice Documentserver

CVE-2026-41034

ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via pictFmla.cbBufInCtlStm and other vectors), leading to an information leak and ASLR bypass.

Vulnerability class: Buffer Overflow

EPSS: 0.000 (1.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.0 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N.

Affected products

Ascensio Onlyoffice Documentserver — versions 0

Weakness classification (CWE)

CWE-125 — Out-of-bounds Read

References

github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md

Frequently asked questions

What is CVE-2026-41034?: CVE-2026-41034 is a medium-severity vulnerability in Ascensio Onlyoffice Documentserver, classified under Out-of-bounds Read. CVSS score: 5.0/10. Published 2026-04-16.
How severe is CVE-2026-41034?: Medium severity. CVSS v3 base score is 5.0 out of 10.