6.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41511

CVE-2026-41511: OpenMcdf has an Infinite loop DoS via crafted CFB directory cycle

OpenMcdf is a fully .NET / C# library to manipulate Compound File Binary File Format files, also known as Structured Storage. Prior to version 3.1.3, OpenMcdf does not detect cycles in the directory entry red-black tree of a Compound File Binary (CFB) document. A crafted CFB file with a cycle in the LeftSiblingID / RightSiblingID chain causes Storage.EnumerateEntries() and Storage.OpenStream() to loop indefinitely, consuming the calling thread with no possibility of recovery via try/catch. This issue has been patched in version 3.1.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41511

CVE-2026-41511:

6.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
OpenMcdf	nuget	< 3.1.3	3.1.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an infinite loop denial of service in OpenMcdf when parsing a crafted Compound File Binary (CFB) file. The root cause is the lack of cycle detection when traversing the directory entry tree, which is structured as a red-black tree. An attacker can create a file where directory entries' sibling pointers form a cycle (e.g., entry A points to B, and B points back to A).

When OpenMcdf processes this file, two code paths are affected:

When Storage.EnumerateEntries() is called, it uses DirectoryTreeEnumerator. The MoveNext() method of the enumerator would traverse the cycle indefinitely, never returning false. This would cause any loop iterating over the entries (like a foreach) to hang, consuming CPU and memory.
When Storage.OpenStream() is called, it internally calls DirectoryTree.TryGetDirectoryEntry to locate the stream's directory entry. This function also traverses the directory tree and, without cycle detection, would loop forever when encountering a crafted cycle.

The provided patch for commit 24f445a557fc4f46461cf6d02d296cce16c293a0 shows the fix applied to DirectoryTreeEnumerator.MoveNext() by implementing Brent's cycle detection algorithm. This prevents the infinite loop when enumerating entries. While the patch for DirectoryTree.TryGetDirectoryEntry was not directly provided in the commit details, the vulnerability description explicitly identifies it as a vulnerable function. The fix for both is the introduction of cycle detection in the tree traversal logic.

Vulnerable functions

OpenMcdf.DirectoryTreeEnumerator.MoveNext

OpenMcdf/DirectoryTreeEnumerator.cs

This function is an enumerator that traverses the directory tree of a Compound File Binary (CFB) file. Before the patch, it lacked cycle detection. A crafted CFB file with a cycle in the sibling pointers of the directory entries would cause this function to loop indefinitely, as it would never exhaust the stack of entries to visit. The public method `Storage.EnumerateEntries()` uses this enumerator, and a `foreach` loop over its result would never terminate.

OpenMcdf.DirectoryTree.TryGetDirectoryEntry

OpenMcdf/DirectoryTree.cs

This function is responsible for finding a directory entry by name, which involves traversing the directory tree. According to the vulnerability report, this function was also susceptible to an infinite loop when processing a file with a crafted cycle in the directory tree. This function is called by the public method `Storage.OpenStream()`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.